@rtorcato/repo-tooling 3.7.0 → 3.7.2

package/dist/base/fixers.js

@@ -39,16 +39,21 @@ export const BASE_FIXERS = [
     },
     {
         target: 'commitlint',
-        description: 'Scaffold commitlint.config.mjs exporting the preset',
+        description: 'Scaffold commitlint.config.mjs + the husky commit-msg hook, and install @commitlint/cli',
         // Conventional Commits is a repo convention, not a JS one (#309) — the
         // config is identical in any repo. Running commitlint still needs node on
         // PATH, which is why the Swift hooks don't wire a commit-msg hook.
         appliesTo: ['Commitlint'],
-        outputs: ['commitlint.config.mjs'],
+        outputs: ['commitlint.config.mjs', '.husky/commit-msg', 'package.json (devDependencies)'],
+        // safe-merge: only missing devDependencies are added, existing ranges stand.
+        riskLevel: 'safe-merge',
         canFixDrift: true,
         async run({ targetDir }) {
-            await generateCommitlintConfig(targetDir);
-            return { filesWritten: ['commitlint.config.mjs'] };
+            const filesWritten = await generateCommitlintConfig(targetDir);
+            if (filesWritten.includes('package.json')) {
+                console.error(chalk.dim('   reminder: run `pnpm install` to install commitlint'));
+            }
+            return { filesWritten };
         },
     },
     {

package/dist/base/github-settings.js

@@ -411,17 +411,22 @@ export function buildGhApplyCommands(state) {
  * on skip (no gh/auth/remote, or already compliant), logging the reason. Mirrors
  * the "no package.json found — skipping" fixer pattern. Read-only unless a delta
  * exists, so re-runs (walk-all hits it up to 3×) are safe.
+ *
+ * Reached from the `github-settings` fixer, so its advisories go to
+ * `console.error` for the same reason the fixers' do (#357): stdout carries the
+ * `--json` payload. #358 fixed the fixer files but not this one — it isn't a
+ * fixer file, it's just called by one.
  */
 export async function applyGithubSettings(dir, exec) {
     if (!(await fs.pathExists(path.join(dir, '.git')))) {
-        console.log(chalk.gray('   skipped — not a git repository'));
+        console.error(chalk.gray('   skipped — not a git repository'));
         return [];
     }
     // Bind gh's cwd to the target dir so its repo resolution honors `-d` (#218).
     const gh = exec ?? ((args, stdin) => realGhExec(args, stdin, dir));
     const probe = await probeRepo(gh);
     if ('skip' in probe) {
-        console.log(chalk.gray(`   skipped — ${probe.skip}`));
+        console.error(chalk.gray(`   skipped — ${probe.skip}`));
         return [];
     }
     const { info } = probe;
@@ -442,7 +447,7 @@ export async function applyGithubSettings(dir, exec) {
         if (r.ok)
             applied.push(cmd.label);
         else
-            console.log(chalk.yellow(`   could not apply ${cmd.label}: ${r.stderr.trim() || 'gh error'}`));
+            console.error(chalk.yellow(`   could not apply ${cmd.label}: ${r.stderr.trim() || 'gh error'}`));
     }
     // Code-scanning ruleset (#269): POST only when CodeQL is on and no active gate
     // covers the default branch — the check re-read keeps this idempotent.
@@ -453,9 +458,9 @@ export async function applyGithubSettings(dir, exec) {
         if (r.ok)
             applied.push(label);
         else
-            console.log(chalk.yellow(`   could not apply ${label}: ${r.stderr.trim() || 'gh error'}`));
+            console.error(chalk.yellow(`   could not apply ${label}: ${r.stderr.trim() || 'gh error'}`));
     }
     if (applied.length === 0)
-        console.log(chalk.gray('   already configured — nothing to apply'));
+        console.error(chalk.gray('   already configured — nothing to apply'));
     return applied;
 }

package/dist/cli/commands/doctor.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import chalk from 'chalk';
 import fs from 'fs-extra';
 import { renderGitHubWorkflow } from '../../base/ci.js';
-import { githubJobs } from '../../languages/js/ci.js';
+import { githubJobs, scriptsOf } from '../../languages/js/ci.js';
 import { inferProjectConfig } from '../../languages/js/fixers.js';
 import { PERL_GIT_HOOKS, runPerlChecks } from '../../languages/perl/checks.js';
 import { readPerlProject, renderPerlWorkflow } from '../../languages/perl/ci.js';
@@ -17,7 +17,7 @@ import { checkGitIdentity } from '../../base/git-identity.js';
 import { LOCKFILE_VERSION, readLockfile } from '../utils/lockfile.js';
 import { declinedInLock, getFixTargetForCheck } from './fix-targets.js';
 import { checkAiSetup, checkCodeowners, checkCodeQL, checkCommunityHealth, checkCoverageUpload, checkDependabot, checkEditorConfig, checkFile, checkGitHooks, checkGitHubActions, checkGitLabCI, checkNestedLanguages, checkPrePushHook, checkReadmeBadges, COMMITLINT_FILE_CHECK, } from '../../base/checks.js';
-import { allDeps, checkAreTheTypesWrong, checkConfigSchemaVersions, checkDocsSite, checkEnginesNode, checkGitDependencies, checkKnip, checkLintStaged, checkNodeVersionConsistency, checkNodeVersionPin, checkPackageJson, checkPublint, checkSemanticRelease, checkSizeLimit, checkTailwind, checkPnpmWorkspace, checkTreeshakeSetup, checkTurborepo, checkTypedoc, checkVerifyScript, checkVscodeExtensions, evaluateNodeVersion, FILE_CHECKS, findDocsAppDir, jsBadgeAudience, jsGitHooksProfile, readPackageJson, } from '../../languages/js/checks.js';
+import { allDeps, checkAreTheTypesWrong, checkConfigSchemaVersions, checkDocsSite, checkEnginesNode, checkGitDependencies, checkKnip, checkLintStaged, checkNodeVersionConsistency, checkNodeVersionPin, checkPackageJson, checkPublint, checkSemanticRelease, checkSizeLimit, checkTailwind, checkBuildApprovals, checkPnpmWorkspace, checkTreeshakeSetup, checkTurborepo, checkTypedoc, checkVerifyScript, checkVscodeExtensions, evaluateNodeVersion, FILE_CHECKS, findDocsAppDir, jsBadgeAudience, jsGitHooksProfile, readPackageJson, } from '../../languages/js/checks.js';
 export { evaluateNodeVersion };
 const PACKAGE = '@rtorcato/repo-tooling';
 // Detects the broken-release-on-protected-main footgun: a workflow that runs
@@ -302,6 +302,7 @@ export async function runDoctor(dir) {
     results.push(await checkPublint(targetDir, pkg));
     results.push(await checkTreeshakeSetup(targetDir, pkg));
     results.push(await checkPnpmWorkspace(targetDir, pkg));
+    results.push(await checkBuildApprovals(targetDir, pkg));
     // Turborepo is monorepo-only — only surface the check when a workspace exists.
     if (await fs.pathExists(path.join(targetDir, 'pnpm-workspace.yaml'))) {
         results.push(await checkTurborepo(targetDir));
@@ -318,7 +319,9 @@ export async function runDoctor(dir) {
     results.push(...(await runBaseChecks(targetDir, lock, {
         hooks: jsGitHooksProfile(pkg),
         badges: { audience: jsBadgeAudience(pkg), fixTarget: 'badges' },
-        presetWorkflow: renderGitHubWorkflow(githubJobs(inferProjectConfig(pkg))),
+        // Same `scripts` gating the fixer applies, or the workflow doctor
+        // compares against would reference steps the fixer never writes (#364).
+        presetWorkflow: renderGitHubWorkflow(githubJobs(inferProjectConfig(pkg), { scripts: scriptsOf(pkg) })),
         language,
         codeqlLanguages: languageModule.codeqlLanguages,
     })));

package/dist/cli/generators/git.js

@@ -41,14 +41,10 @@ export async function generateHuskyConfig(config, targetDir) {
             await generatePrePushHook(targetDir);
         }
     }
-    // Commit-msg hook (if commitlint is enabled). husky v10 format — no v9
-    // bootstrap. $1 is still the commit-message file path git passes through.
-    if (config.commitLint) {
-        const commitMsgPath = path.join(huskyDir, 'commit-msg');
-        const commitMsgContent = 'npx --no -- commitlint --edit $1\n';
-        await fs.writeFile(commitMsgPath, commitMsgContent);
-        await fs.chmod(commitMsgPath, 0o755);
-    }
+    // The commit-msg hook is NOT written here (#362). It runs commitlint via
+    // `npx --no`, which refuses to install a missing binary, so emitting it
+    // without also installing @commitlint/cli rejected every commit in the repo.
+    // It belongs to generateCommitlintConfig, which owns both halves.
     // lint-staged configuration in package.json
     const packageJsonPath = path.join(targetDir, 'package.json');
     const packageJson = await fs.readJson(packageJsonPath);
@@ -71,11 +67,74 @@ export async function generatePrePushHook(targetDir) {
     await fs.writeFile(prePushPath, PRE_PUSH_HOOK_CONTENT);
     await fs.chmod(prePushPath, 0o755);
 }
+/** Package versions the commit-msg hook needs on disk to run at all. */
+export const COMMITLINT_DEPS = {
+    '@commitlint/cli': '^20.0.0',
+    '@commitlint/config-conventional': '^20.0.0',
+};
+/** True when husky owns this repo's hooks — the only case where .husky/commit-msg runs. */
+async function usesHusky(targetDir) {
+    if (await fs.pathExists(path.join(targetDir, '.husky')))
+        return true;
+    const pkgPath = path.join(targetDir, 'package.json');
+    if (!(await fs.pathExists(pkgPath)))
+        return false;
+    const pkg = (await fs.readJson(pkgPath));
+    const deps = {
+        ...(pkg.dependencies ?? {}),
+        ...(pkg.devDependencies ?? {}),
+    };
+    return 'husky' in deps;
+}
+/**
+ * commitlint's config *and* the hook that runs it, as one unit (#362).
+ *
+ * These used to be split across two targets: `fix husky` wrote
+ * `.husky/commit-msg`, `fix commitlint` wrote the config, and neither installed
+ * `@commitlint/cli`. Since the hook body is `npx --no -- commitlint --edit $1`
+ * and `--no` refuses to install anything, a repo that ran only `fix husky` had
+ * every `git commit` rejected — discovered at the worst possible moment, and
+ * looking like a broken repo rather than a missing opt-in.
+ *
+ * The hook is only written when husky owns the repo's hooks. The Swift path
+ * uses `core.hooksPath` and deliberately wires no commit-msg hook, so a
+ * `.husky/` file there would simply never run.
+ *
+ * @returns the files written, relative to targetDir.
+ */
 export async function generateCommitlintConfig(targetDir) {
-    const commitlintConfigPath = path.join(targetDir, 'commitlint.config.mjs');
-    const commitlintConfig = `export { default } from '@rtorcato/repo-tooling/commitlint/config'
-`;
-    await fs.writeFile(commitlintConfigPath, commitlintConfig);
+    const filesWritten = ['commitlint.config.mjs'];
+    await fs.writeFile(path.join(targetDir, 'commitlint.config.mjs'), `export { default } from '@rtorcato/repo-tooling/commitlint/config'\n`);
+    if (await usesHusky(targetDir)) {
+        // husky v10 format — no v9 bootstrap. $1 is the commit-message file path
+        // git passes through.
+        const huskyDir = path.join(targetDir, '.husky');
+        await fs.ensureDir(huskyDir);
+        const commitMsgPath = path.join(huskyDir, 'commit-msg');
+        await fs.writeFile(commitMsgPath, 'npx --no -- commitlint --edit $1\n');
+        await fs.chmod(commitMsgPath, 0o755);
+        filesWritten.push('.husky/commit-msg');
+    }
+    // @commitlint/cli is an *optional* peer of repo-tooling, so it never arrives
+    // transitively — without this the hook we just wrote cannot run.
+    const pkgPath = path.join(targetDir, 'package.json');
+    if (await fs.pathExists(pkgPath)) {
+        const pkg = (await fs.readJson(pkgPath));
+        const devDeps = { ...(pkg.devDependencies ?? {}) };
+        let added = false;
+        for (const [name, range] of Object.entries(COMMITLINT_DEPS)) {
+            if (!devDeps[name]) {
+                devDeps[name] = range;
+                added = true;
+            }
+        }
+        if (added) {
+            pkg.devDependencies = devDeps;
+            await fs.writeJson(pkgPath, pkg, { spaces: 2 });
+            filesWritten.push('package.json');
+        }
+    }
+    return filesWritten;
 }
 async function generateGitignore(config, targetDir) {
     const gitignorePath = path.join(targetDir, '.gitignore');

package/dist/cli/generators/github-actions.js

@@ -26,9 +26,12 @@ export const CI_WORKFLOW = '.github/workflows/ci.yml';
  * #340). Same self-enforced safe-add as github-workflows.ts, widened to "or is
  * byte-identical anyway" so a no-op regeneration still reports honestly. Only a
  * caller that has told the user this workflow itself is drifting passes true.
+ * @param scripts The target's package.json scripts, so the workflow only calls
+ * commands that exist (#364). Omit on the `setup` path, which writes the
+ * scripts itself as part of the same scaffold.
  * @returns the files actually written, relative to targetDir.
  */
-export async function generateGitHubActions(config, targetDir, { overwrite = false } = {}) {
+export async function generateGitHubActions(config, targetDir, { overwrite = false, scripts } = {}) {
     const workflowsDir = path.join(targetDir, '.github', 'workflows');
     await fs.ensureDir(workflowsDir);
     // This is the JS path specifically. Swift (#287) renders its own workflow
@@ -37,7 +40,7 @@ export async function generateGitHubActions(config, targetDir, { overwrite = fal
     // shared entry point would mean inventing a fake config to pass in. Both
     // paths meet at renderGitHubWorkflow() in src/base/ci.ts, which is the seam
     // that actually matters.
-    const workflow = renderGitHubWorkflow(githubJobs(config));
+    const workflow = renderGitHubWorkflow(githubJobs(config, { scripts }));
     const ciPath = path.join(workflowsDir, 'ci.yml');
     const existing = (await fs.pathExists(ciPath)) ? await fs.readFile(ciPath, 'utf-8') : null;
     const filesWritten = [];

package/dist/cli/generators/misc.js

@@ -1,5 +1,11 @@
+import { execFileSync } from 'node:child_process';
 import path from 'node:path';
 import fs from 'fs-extra';
+/**
+ * Only used when pnpm isn't on PATH to ask. corepack requires an exact
+ * `pnpm@x.y.z` — a range is rejected — so this has to be a concrete version.
+ */
+export const PNPM_FALLBACK_VERSION = '11.1.3';
 const EDITORCONFIG_CONTENT = `root = true
 
 [*]
@@ -194,6 +200,46 @@ export async function ensureEnginesNode(targetDir, version = '>=22') {
     await fs.writeJson(pkgPath, pkg, { spaces: 2 });
     return 'added';
 }
+/** The pnpm this machine runs, or null when pnpm isn't on PATH. */
+export function detectPnpmVersion() {
+    try {
+        const out = execFileSync('pnpm', ['--version'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return /^\s*(\d+\.\d+\.\d+)/.exec(out)?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Pin `packageManager` so `pnpm/action-setup` has a version to resolve (#364).
+ *
+ * The generated workflow uses `pnpm/action-setup` with no `version:` input,
+ * which is correct *provided* something declares the version. Nothing in the
+ * `fix` path did, so every scaffolded pipeline died at setup with "No pnpm
+ * version is specified" — before a single check ran.
+ *
+ * The value is detected from the pnpm actually running, not hardcoded: this is
+ * a public CLI and a baked-in version would pin strangers' repos to whatever
+ * was current when this file was last touched. `PNPM_FALLBACK_VERSION` is only
+ * for a machine with no pnpm on PATH, and corepack will fetch it either way.
+ *
+ * @returns 'added' | 'already-set' | 'no-package-json'
+ */
+export async function ensurePackageManager(targetDir, version = detectPnpmVersion() ?? PNPM_FALLBACK_VERSION) {
+    const pkgPath = path.join(targetDir, 'package.json');
+    if (!(await fs.pathExists(pkgPath)))
+        return 'no-package-json';
+    const pkg = (await fs.readJson(pkgPath));
+    if (typeof pkg.packageManager === 'string' && pkg.packageManager.trim() !== '') {
+        return 'already-set';
+    }
+    pkg.packageManager = `pnpm@${version}`;
+    await fs.writeJson(pkgPath, pkg, { spaces: 2 });
+    return 'added';
+}
 /**
  * Build a knip config whose `entry` matches the project's build model, read
  * from package.json `exports`:

package/dist/cli/generators/package-json.js

@@ -1,9 +1,6 @@
 import fs from 'fs-extra';
 import path from 'node:path';
-// Exact pnpm version for the `packageManager` field — corepack requires a
-// pinned `pnpm@x.y.z` (not a range), and it's the single source of truth for
-// pnpm/action-setup, so the generated workflows drop their `version:` inputs.
-const PNPM_VERSION = '11.1.3';
+import { PNPM_FALLBACK_VERSION, detectPnpmVersion } from './misc.js';
 export async function generatePackageJson(config, targetDir) {
     const packageJsonPath = path.join(targetDir, 'package.json');
     let existingPackageJson = {};
@@ -16,7 +13,9 @@ export async function generatePackageJson(config, targetDir) {
         version: '0.1.0',
         description: '',
         type: 'module',
-        packageManager: `pnpm@${PNPM_VERSION}`,
+        // The single source of truth for pnpm/action-setup, which is why the
+        // generated workflows carry no `version:` input (#364).
+        packageManager: `pnpm@${detectPnpmVersion() ?? PNPM_FALLBACK_VERSION}`,
         ...existingPackageJson,
         scripts: {
             ...getScripts(config, { includeTreeshake }),
@@ -161,6 +160,34 @@ function getScripts(config, opts = {}) {
     }
     return scripts;
 }
+/**
+ * Add any of `scripts` the package.json doesn't already define, leaving every
+ * existing value alone. Returns true when something was written.
+ *
+ * A `fix` target that scaffolds a tool's config but no way to run it leaves the
+ * repo half-wired: the generated CI called `pnpm check`, and `fix verify`
+ * refused to compose a chain, both because no target ever created that script
+ * (#364).
+ */
+export async function ensureScripts(targetDir, scripts) {
+    const pkgPath = path.join(targetDir, 'package.json');
+    if (!(await fs.pathExists(pkgPath)))
+        return false;
+    const pkg = (await fs.readJson(pkgPath));
+    const existing = { ...(pkg.scripts ?? {}) };
+    let added = false;
+    for (const [name, command] of Object.entries(scripts)) {
+        if (!existing[name]) {
+            existing[name] = command;
+            added = true;
+        }
+    }
+    if (!added)
+        return false;
+    pkg.scripts = existing;
+    await fs.writeJson(pkgPath, pkg, { spaces: 2 });
+    return true;
+}
 export function composeVerifyScript(config, opts = {}) {
     const cmds = [];
     if (config.typescript.enabled)
@@ -216,6 +243,10 @@ export function composeVerifyScriptFromPkg(pkg, opts = {}) {
         cmds.push('pnpm test --ci');
     else if (deps['@playwright/test'] || deps.cypress)
         cmds.push('pnpm test:e2e');
+    // A repo can run tests without any runner we recognise — `node --test`, for
+    // one. Its `test` script is still the thing verify should call (#364).
+    else if (scripts.test)
+        cmds.push('pnpm test');
     if (opts.includeTreeshake)
         cmds.push('pnpm treeshake');
     if (deps.publint || scripts.publint)

package/dist/languages/js/checks.js

@@ -861,6 +861,88 @@ export async function checkPnpmWorkspace(dir, pkg) {
         hint,
     };
 }
+/** The lifecycle scripts pnpm refuses to run until the package is approved. */
+const BUILD_LIFECYCLE_SCRIPTS = ['preinstall', 'install', 'postinstall'];
+/**
+ * Package names that already have a build decision recorded — approved or
+ * declined, both count. `allowBuilds` is a map (pnpm 11); the older
+ * `onlyBuiltDependencies` / `ignoredBuiltDependencies` lists are still read so
+ * a repo that hasn't migrated isn't nagged about choices it already made.
+ */
+export function decidedBuilds(yaml) {
+    const decided = new Set();
+    const lines = yaml.split('\n');
+    let inBlock = false;
+    for (const line of lines) {
+        if (/^(allowBuilds|onlyBuiltDependencies|ignoredBuiltDependencies):/.test(line)) {
+            inBlock = true;
+            continue;
+        }
+        if (/^\S/.test(line)) {
+            inBlock = false;
+            continue;
+        }
+        if (!inBlock)
+            continue;
+        // `  esbuild: true` (map) or `  - esbuild` (list).
+        const name = /^\s*-?\s*['"]?(@?[\w./-]+?)['"]?\s*:?\s*(?:true|false)?\s*$/.exec(line)?.[1];
+        if (name)
+            decided.add(name);
+    }
+    return decided;
+}
+/**
+ * Direct dependencies whose install would run a build script (#364).
+ *
+ * pnpm 11 turned undecided build scripts into a hard error, so
+ * `pnpm install --frozen-lockfile` exits non-zero with ERR_PNPM_IGNORED_BUILDS
+ * — a guaranteed CI failure. Locally the same message reads as advisory, which
+ * is exactly why it gets missed until the pipeline goes red.
+ *
+ * Only direct dependencies are inspected: reaching transitive ones means
+ * walking node_modules/.pnpm, and the packages that trip this in practice
+ * (better-sqlite3, @prisma/client, esbuild) are ones the repo asked for by
+ * name. A transitive offender is a false negative, never a false positive.
+ */
+export async function checkBuildApprovals(dir, pkg) {
+    const check = 'pnpm build approvals';
+    const deps = allDeps(pkg);
+    const modulesDir = path.join(dir, 'node_modules');
+    if (Object.keys(deps).length === 0 || !(await fs.pathExists(modulesDir))) {
+        // Nothing installed to inspect — the manifest alone can't say which
+        // packages ship an install script.
+        return { check, status: 'ok', detail: 'no installed dependencies to inspect' };
+    }
+    const yamlPath = path.join(dir, WORKSPACE_FILE);
+    const decided = decidedBuilds((await fs.pathExists(yamlPath)) ? await fs.readFile(yamlPath, 'utf-8') : '');
+    const undecided = [];
+    for (const name of Object.keys(deps)) {
+        if (decided.has(name))
+            continue;
+        const depPkgPath = path.join(modulesDir, name, 'package.json');
+        if (!(await fs.pathExists(depPkgPath)))
+            continue;
+        let scripts = {};
+        try {
+            const depPkg = (await fs.readJson(depPkgPath));
+            scripts = depPkg.scripts ?? {};
+        }
+        catch {
+            continue;
+        }
+        if (BUILD_LIFECYCLE_SCRIPTS.some((s) => scripts[s]))
+            undecided.push(name);
+    }
+    if (undecided.length === 0) {
+        return { check, status: 'ok', detail: 'every dependency with a build script has a decision' };
+    }
+    return {
+        check,
+        status: 'drift',
+        detail: `${undecided.length} dependenc${undecided.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${undecided.join(', ')}`,
+        hint: `Record a decision per package under \`allowBuilds:\` in ${WORKSPACE_FILE} (\`name: true\` to run it, \`false\` to skip). pnpm 11 fails \`pnpm install --frozen-lockfile\` outright while any is undecided, so CI cannot pass until each is answered.`,
+    };
+}
 /** The docs app dir (apps/docs or apps/doc) if a Docusaurus config lives there. */
 export async function findDocsAppDir(dir) {
     for (const app of ['apps/docs', 'apps/doc']) {

package/dist/languages/js/ci.js

@@ -2,10 +2,12 @@
 export function usesCoverage(config) {
     return config.testing.framework === 'vitest';
 }
+/** The package.json script the lint job runs — `check` under Biome, else `lint`. */
+function lintScript(config) {
+    return config.linting.tool === 'biome' || config.linting.tool === 'both' ? 'check' : 'lint';
+}
 function lintCommand(config) {
-    return config.linting.tool === 'biome' || config.linting.tool === 'both'
-        ? 'pnpm check'
-        : 'pnpm lint';
+    return `pnpm ${lintScript(config)}`;
 }
 /**
  * Checkout → Node → pnpm → restore the cache the `dependencies` job primed.
@@ -62,40 +64,53 @@ const DEPENDENCIES_JOB = {
       - name: 📦 Install dependencies
         run: pnpm install --frozen-lockfile`,
 };
+/**
+ * `JobOptions.scripts` for a real repo. A package.json with no `scripts` block
+ * yields `{}` — "this repo has no scripts", which gates every step off —
+ * whereas no package.json at all yields undefined, the setup shape.
+ */
+export function scriptsOf(pkg) {
+    if (!pkg)
+        return undefined;
+    return pkg.scripts ?? {};
+}
+/** Emit a step only when the script it runs exists (or we can't know yet). */
+function stepFor(opts, script, step) {
+    return !opts.scripts || script in opts.scripts ? step : null;
+}
+/** Join the steps that survived gating onto the shared setup preamble. */
+function jobSteps(steps) {
+    const kept = steps.filter((s) => s !== null);
+    return kept.length > 0 ? [SETUP_STEPS, ...kept].join('\n\n') : null;
+}
 /**
  * The GitHub Actions jobs for a JS repo, in workflow order. The `release` job
  * needs the ids of everything that ran before it, so the list is assembled
  * rather than filtered from a fixed shape.
  */
-export function githubJobs(config) {
+export function githubJobs(config, opts = {}) {
     const hasTypeScript = config.typescript.enabled;
     const hasTests = config.testing.framework !== 'none';
     const hasBuild = config.bundler !== 'none';
     const isLibrary = config.projectType === 'library';
     const hasCoverage = usesCoverage(config);
-    const jobs = [
-        DEPENDENCIES_JOB,
-        {
-            id: 'lint',
-            needs: ['dependencies'],
-            steps: `${SETUP_STEPS}
-
-      - name: 🔍 Run linting
-        run: ${lintCommand(config)}
-
-      - name: 🧹 Check for unused files, exports, and dependencies
-        run: pnpm knip`,
-        },
-    ];
+    const jobs = [DEPENDENCIES_JOB];
+    const lintSteps = jobSteps([
+        stepFor(opts, lintScript(config), `      - name: 🔍 Run linting
+        run: ${lintCommand(config)}`),
+        stepFor(opts, 'knip', `      - name: 🧹 Check for unused files, exports, and dependencies
+        run: pnpm knip`),
+    ]);
+    if (lintSteps) {
+        jobs.push({ id: 'lint', needs: ['dependencies'], steps: lintSteps });
+    }
     if (hasTypeScript) {
-        jobs.push({
-            id: 'typecheck',
-            needs: ['dependencies'],
-            steps: `${SETUP_STEPS}
-
-      - name: 🔍 Type check
-        run: pnpm typecheck`,
-        });
+        const steps = jobSteps([
+            stepFor(opts, 'typecheck', `      - name: 🔍 Type check
+        run: pnpm typecheck`),
+        ]);
+        if (steps)
+            jobs.push({ id: 'typecheck', needs: ['dependencies'], steps });
     }
     if (hasTests) {
         const coverageUpload = hasCoverage
@@ -107,18 +122,19 @@ export function githubJobs(config) {
           token: \${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false`
             : '';
-        jobs.push({
-            id: 'test',
-            needs: ['dependencies'],
-            steps: `${SETUP_STEPS}
-
-      - name: 🧪 Run tests
-        run: ${hasCoverage ? 'pnpm coverage' : 'pnpm test'}${coverageUpload}`,
-        });
+        // Fall back to `pnpm test` when the repo has no coverage script — the
+        // coverage upload goes with it, since there'd be no lcov to upload.
+        const useCoverage = hasCoverage && (!opts.scripts || 'coverage' in opts.scripts);
+        const steps = jobSteps([
+            stepFor(opts, useCoverage ? 'coverage' : 'test', `      - name: 🧪 Run tests
+        run: ${useCoverage ? 'pnpm coverage' : 'pnpm test'}${useCoverage ? coverageUpload : ''}`),
+        ]);
+        if (steps)
+            jobs.push({ id: 'test', needs: ['dependencies'], steps });
     }
-    if (hasBuild) {
+    if (hasBuild && (!opts.scripts || 'build' in opts.scripts)) {
         // attw and publint validate what's about to be published — libraries only.
-        const attw = isLibrary
+        const attw = isLibrary && (!opts.scripts || 'attw' in opts.scripts)
             ? '\n      - name: 🔍 Validate type resolution (are-the-types-wrong)\n        run: pnpm attw\n'
             : '';
         const publint = config.publint

package/dist/languages/js/fixers.js

@@ -8,8 +8,16 @@ import { CI_WORKFLOW, generateGitHubActions } from '../../cli/generators/github-
 import { generateGitLabCI } from '../../cli/generators/gitlab-ci.js';
 import { GH_WORKFLOWS, generateGhWorkflow } from '../../cli/generators/github-workflows.js';
 import { generateESLintConfig, generatePrettierConfig } from '../../cli/generators/linting.js';
-import { alignNodeVersion, ensureEnginesNode, generateKnipConfig, generateNvmrc, generateSizeLimitConfig, generateVscodeExtensions, } from '../../cli/generators/misc.js';
-import { composeVerifyScriptFromPkg } from '../../cli/generators/package-json.js';
+import { alignNodeVersion, ensureEnginesNode, ensurePackageManager, generateKnipConfig, generateNvmrc, generateSizeLimitConfig, generateVscodeExtensions, } from '../../cli/generators/misc.js';
+import { scriptsOf } from './ci.js';
+import { composeVerifyScriptFromPkg, ensureScripts } from '../../cli/generators/package-json.js';
+/** Kept in step with the biome branch of getScripts() in package-json.ts. */
+const BIOME_SCRIPTS = {
+    lint: 'biome lint .',
+    format: 'biome format .',
+    check: 'biome check .',
+    'check:fix': 'biome check --fix .',
+};
 import { WORKSPACE_FILE, dependsOnEsbuild, ensurePnpmSettings, familyGlob, } from '../../cli/generators/pnpm-workspace.js';
 import { generatePostcss } from '../../cli/generators/postcss.js';
 import { generateCypressConfig, generateVitestConfig } from '../../cli/generators/testing.js';
@@ -114,13 +122,18 @@ const GH_WORKFLOW_FIXERS = GH_WORKFLOWS.map((name) => ({
 export const FIXERS = [
     {
         target: 'biome',
-        description: 'Scaffold biome.json extending the @rtorcato/repo-tooling preset',
+        description: 'Scaffold biome.json extending the @rtorcato/repo-tooling preset, plus the scripts that run it',
         appliesTo: ['Biome'],
-        outputs: ['biome.json'],
+        outputs: ['biome.json', 'package.json (scripts)'],
         canFixDrift: true,
         async run({ targetDir }) {
             const result = await copyPreset('biome', targetDir);
-            return { filesWritten: [result.target] };
+            const filesWritten = [result.target];
+            // A config with no way to run it left `pnpm check` undefined, which the
+            // generated CI called and `fix verify` needed to compose a chain (#364).
+            if (await ensureScripts(targetDir, BIOME_SCRIPTS))
+                filesWritten.push('package.json');
+            return { filesWritten };
         },
     },
     {
@@ -193,7 +206,7 @@ export const FIXERS = [
     },
     {
         target: 'husky',
-        description: 'Set up Husky + lint-staged (and a `pnpm verify` pre-push hook)',
+        description: 'Set up Husky + lint-staged (and a `pnpm verify` pre-push hook). Commit-message linting is `fix commitlint`.',
         appliesTo: ['Git hooks', 'lint-staged', 'Pre-push hook'],
         outputs: ['.husky/pre-commit', '.husky/pre-push', 'package.json (lint-staged field)'],
         riskLevel: 'safe-merge',
@@ -304,7 +317,7 @@ export const FIXERS = [
         target: 'github-actions',
         description: 'Scaffold .github/workflows/ci.yml (+ codecov.yml when tests run)',
         appliesTo: ['GitHub Actions', 'Coverage upload', 'npm OIDC publish'],
-        outputs: [CI_WORKFLOW, 'codecov.yml'],
+        outputs: [CI_WORKFLOW, 'codecov.yml', 'package.json (packageManager field)'],
         canFixDrift: true,
         async run({ targetDir, pkg, result }) {
             // Only a `GitHub Actions` finding means the user was shown that the
@@ -313,7 +326,14 @@ export const FIXERS = [
             // customized ci.yml down with it (#349).
             const filesWritten = await generateGitHubActions(inferProjectConfig(pkg), targetDir, {
                 overwrite: result.check === 'GitHub Actions',
+                // Only reference scripts this repo actually has (#364).
+                scripts: scriptsOf(pkg),
             });
+            // `pnpm/action-setup` is emitted without a `version:` input, so without
+            // this every job dies at setup with "No pnpm version is specified".
+            if ((await ensurePackageManager(targetDir)) === 'added') {
+                filesWritten.push('package.json');
+            }
             if (!filesWritten.includes(CI_WORKFLOW)) {
                 console.error(chalk.yellow(`   ${CI_WORKFLOW} differs from the preset — left as-is; run \`fix github-actions --diff\` to see the delta`));
             }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.7.0",
+	"version": "3.7.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [