@rtorcato/repo-tooling 3.7.4 → 3.8.1

package/dist/cli/commands/doctor.js

@@ -17,7 +17,7 @@ import { checkGitIdentity } from '../../base/git-identity.js';
 import { LOCKFILE_VERSION, readLockfile } from '../utils/lockfile.js';
 import { declinedInLock, getFixTargetForCheck } from './fix-targets.js';
 import { checkAiSetup, checkCodeowners, checkCodeQL, checkCommunityHealth, checkCoverageUpload, checkDependabot, checkEditorConfig, checkFile, checkGitHooks, checkGitHubActions, checkGitLabCI, checkNestedLanguages, checkPrePushHook, checkReadmeBadges, COMMITLINT_FILE_CHECK, } from '../../base/checks.js';
-import { allDeps, checkAreTheTypesWrong, checkConfigSchemaVersions, checkDocsSite, checkEnginesNode, checkGitDependencies, checkKnip, checkLintStaged, checkNodeVersionConsistency, checkNodeVersionPin, checkPackageJson, checkPublint, checkSemanticRelease, checkSizeLimit, checkTailwind, checkBuildApprovals, checkPnpmWorkspace, checkTreeshakeSetup, checkTurborepo, checkTypedoc, checkVerifyScript, checkVscodeExtensions, evaluateNodeVersion, FILE_CHECKS, findDocsAppDir, jsBadgeAudience, jsGitHooksProfile, readPackageJson, } from '../../languages/js/checks.js';
+import { allDeps, checkAreTheTypesWrong, checkConfigSchemaVersions, checkDocsSite, checkEnginesNode, checkGitDependencies, checkKnip, checkLintStaged, checkNodeVersionConsistency, checkNodeVersionPin, checkPackageJson, checkPackageManager, checkPublint, checkSemanticRelease, checkSizeLimit, checkTailwind, checkBuildApprovals, checkPnpmWorkspace, checkTreeshakeSetup, checkTurborepo, checkTypedoc, checkVerifyScript, checkVscodeExtensions, evaluateNodeVersion, FILE_CHECKS, findDocsAppDir, jsBadgeAudience, jsGitHooksProfile, readPackageJson, } from '../../languages/js/checks.js';
 export { evaluateNodeVersion };
 const PACKAGE = '@rtorcato/repo-tooling';
 // Detects the broken-release-on-protected-main footgun: a workflow that runs
@@ -282,6 +282,7 @@ export async function runDoctor(dir) {
     results.push(evaluateNodeVersion(process.version));
     results.push(checkPackageJson(pkg));
     results.push(checkEnginesNode(pkg));
+    results.push(await checkPackageManager(targetDir, pkg));
     results.push(await checkConfigSchemaVersions(targetDir, pkg));
     results.push(checkGitDependencies(pkg));
     results.push(await checkVscodeExtensions(targetDir));

package/dist/cli/commands/fix-targets.js

@@ -1,6 +1,7 @@
 export const FIX_TARGETS = {
     'package.json': 'package-json',
     'engines.node': 'engines',
+    packageManager: 'engines',
     EditorConfig: 'editorconfig',
     'VS Code extensions': 'vscode-extensions',
     'Node version pin': 'nvmrc',

package/dist/languages/js/checks.js

@@ -156,6 +156,38 @@ export function checkPackageJson(pkg) {
         hint: `Run \`pnpm add -D ${PACKAGE}\``,
     };
 }
+/**
+ * Whether the repo installs with pnpm. Three independent signals, any of which
+ * is enough: the workspace file, the lockfile, or a `packageManager` that
+ * already names pnpm. Shared so `packageManager` and `pnpm settings` agree on
+ * what "a pnpm repo" means.
+ */
+export async function usesPnpm(dir, pkg) {
+    return ((await fs.pathExists(path.join(dir, WORKSPACE_FILE))) ||
+        (await fs.pathExists(path.join(dir, 'pnpm-lock.yaml'))) ||
+        (pkg?.packageManager ?? '').startsWith('pnpm'));
+}
+/**
+ * `packageManager` pins the pnpm that `pnpm/action-setup` resolves (#364). The
+ * generated workflow passes no `version:` input, so a pnpm repo without this
+ * field fails CI at setup — before a single check runs (#372).
+ */
+export async function checkPackageManager(dir, pkg) {
+    const check = 'packageManager';
+    if (!(await usesPnpm(dir, pkg))) {
+        return { check, status: 'ok', detail: 'not a pnpm repo' };
+    }
+    const declared = pkg?.packageManager ?? '';
+    if (declared.trim() !== '') {
+        return { check, status: 'ok', detail: `packageManager = ${declared}` };
+    }
+    return {
+        check,
+        status: 'drift',
+        detail: 'packageManager not set in package.json',
+        hint: `Run \`npx ${PACKAGE} fix engines\` to pin the pnpm version CI resolves`,
+    };
+}
 export function checkEnginesNode(pkg) {
     if (!pkg) {
         return {
@@ -844,10 +876,7 @@ export async function checkPnpmWorkspace(dir, pkg) {
     const hint = `Run \`npx ${PACKAGE} fix pnpm-workspace\` to merge them in`;
     const file = path.join(dir, WORKSPACE_FILE);
     const exists = await fs.pathExists(file);
-    const usesPnpm = exists ||
-        (await fs.pathExists(path.join(dir, 'pnpm-lock.yaml'))) ||
-        (pkg?.packageManager ?? '').startsWith('pnpm');
-    if (!usesPnpm) {
+    if (!(await usesPnpm(dir, pkg))) {
         return { check, status: 'ok', detail: 'not a pnpm repo' };
     }
     const yaml = exists ? await fs.readFile(file, 'utf-8') : '';
@@ -894,17 +923,74 @@ export function decidedBuilds(yaml) {
     return decided;
 }
 /**
- * Direct dependencies whose install would run a build script (#364).
+ * Package name encoded in a `node_modules/.pnpm` directory name (#373).
+ *
+ * Entries read `<name>@<version>` with `/` written as `+`, and the version may
+ * carry a peer suffix that contains further `@`s
+ * (`@babel+core@7.0.0_supports-color@8.0.0`), so the separator is the *first*
+ * `@` after index 0 — never the last.
+ */
+export function pnpmStoreDirToName(entry) {
+    const at = entry.indexOf('@', 1);
+    if (at < 1)
+        return null;
+    return entry.slice(0, at).replace('+', '/');
+}
+/**
+ * Transitive packages that ship a build script and have no decision (#373).
+ *
+ * One `package.json` read per unique name — never a recursive walk — and the
+ * whole pass is skipped when `.pnpm` is absent (npm/yarn repos, or nothing
+ * installed). `skip` drops the names the direct pass already owns.
+ */
+async function undecidedTransitiveBuilds(modulesDir, skip) {
+    const store = path.join(modulesDir, '.pnpm');
+    if (!(await fs.pathExists(store)))
+        return [];
+    const seen = new Set();
+    const undecided = new Set();
+    for (const entry of await fs.readdir(store)) {
+        const name = pnpmStoreDirToName(entry);
+        // A package present at two versions has two store dirs; report it once.
+        if (!name || seen.has(name) || skip(name))
+            continue;
+        seen.add(name);
+        // Store directory names come from registry metadata, and only the *first*
+        // `+` is decoded — the rest of the entry passes through literally, so a
+        // hostile name (`..+..@1.0.0` → `../..`) would climb out of the package
+        // directory and have `fs.readJson` read an unrelated file, whose `name`
+        // then lands in the report. Confirm the resolved path stays under this
+        // entry's `node_modules` before reading it.
+        const root = path.resolve(store, entry, 'node_modules');
+        const target = path.join(root, name, 'package.json');
+        if (!target.startsWith(root + path.sep))
+            continue;
+        let depPkg;
+        try {
+            depPkg = await fs.readJson(target);
+        }
+        catch {
+            continue;
+        }
+        const scripts = depPkg.scripts ?? {};
+        // `name` from the manifest is exact; the decoded dir name is the fallback.
+        if (BUILD_LIFECYCLE_SCRIPTS.some((s) => scripts[s]))
+            undecided.add(depPkg.name ?? name);
+    }
+    return [...undecided].filter((n) => !skip(n)).sort();
+}
+/**
+ * Dependencies whose install would run a build script (#364, #373).
  *
  * pnpm 11 turned undecided build scripts into a hard error, so
  * `pnpm install --frozen-lockfile` exits non-zero with ERR_PNPM_IGNORED_BUILDS
  * — a guaranteed CI failure. Locally the same message reads as advisory, which
  * is exactly why it gets missed until the pipeline goes red.
  *
- * Only direct dependencies are inspected: reaching transitive ones means
- * walking node_modules/.pnpm, and the packages that trip this in practice
- * (better-sqlite3, @prisma/client, esbuild) are ones the repo asked for by
- * name. A transitive offender is a false negative, never a false positive.
+ * Direct and transitive offenders are graded apart. A direct one is `drift`:
+ * the repo asked for the package by name and can answer for it. A transitive
+ * one is `optional-missing` — still worth recording, but common enough that
+ * grading it as drift would drown the report in noise.
  */
 export async function checkBuildApprovals(dir, pkg) {
     const check = 'pnpm build approvals';
@@ -935,13 +1021,19 @@ export async function checkBuildApprovals(dir, pkg) {
         if (BUILD_LIFECYCLE_SCRIPTS.some((s) => scripts[s]))
             undecided.push(name);
     }
-    if (undecided.length === 0) {
+    const transitive = await undecidedTransitiveBuilds(modulesDir, (name) => decided.has(name) || name in deps);
+    if (undecided.length === 0 && transitive.length === 0) {
         return { check, status: 'ok', detail: 'every dependency with a build script has a decision' };
     }
+    const parts = [];
+    if (undecided.length)
+        parts.push(`${undecided.length} dependenc${undecided.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${undecided.join(', ')}`);
+    if (transitive.length)
+        parts.push(`${transitive.length} transitive dependenc${transitive.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${transitive.join(', ')}`);
     return {
         check,
-        status: 'drift',
-        detail: `${undecided.length} dependenc${undecided.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${undecided.join(', ')}`,
+        status: undecided.length ? 'drift' : 'optional-missing',
+        detail: parts.join('; '),
         hint: `Record a decision per package under \`allowBuilds:\` in ${WORKSPACE_FILE} (\`name: true\` to run it, \`false\` to skip). pnpm 11 fails \`pnpm install --frozen-lockfile\` outright while any is undecided, so CI cannot pass until each is answered.`,
     };
 }

package/dist/languages/js/fixers.js

@@ -10,6 +10,7 @@ import { GH_WORKFLOWS, generateGhWorkflow } from '../../cli/generators/github-wo
 import { BIOME_CONFIG, generateBiomeConfig, generateESLintConfig, generatePrettierConfig, } from '../../cli/generators/linting.js';
 import { alignNodeVersion, ensureEnginesNode, ensurePackageManager, generateKnipConfig, generateNvmrc, generateSizeLimitConfig, generateVscodeExtensions, } from '../../cli/generators/misc.js';
 import { scriptsOf } from './ci.js';
+import { usesPnpm } from './checks.js';
 import { composeVerifyScriptFromPkg, ensureScripts } from '../../cli/generators/package-json.js';
 /** Kept in step with the biome branch of getScripts() in package-json.ts. */
 const BIOME_SCRIPTS = {
@@ -18,6 +19,15 @@ const BIOME_SCRIPTS = {
     check: 'biome check .',
     'check:fix': 'biome check --fix .',
 };
+/** Kept in step with the eslint branch of getScripts() in package-json.ts. */
+const ESLINT_SCRIPTS = {
+    lint: 'eslint .',
+    'lint:fix': 'eslint . --fix',
+};
+/** Kept in step with the eslint branch of getScripts() in package-json.ts. */
+const PRETTIER_SCRIPTS = {
+    format: 'prettier --write .',
+};
 import { WORKSPACE_FILE, dependsOnEsbuild, ensurePnpmSettings, familyGlob, } from '../../cli/generators/pnpm-workspace.js';
 import { generatePostcss } from '../../cli/generators/postcss.js';
 import { generateCypressConfig, generateVitestConfig } from '../../cli/generators/testing.js';
@@ -151,24 +161,32 @@ export const FIXERS = [
     },
     {
         target: 'eslint',
-        description: 'Scaffold eslint.config.mjs importing the @rtorcato/repo-tooling preset',
+        description: 'Scaffold eslint.config.mjs importing the @rtorcato/repo-tooling preset, plus the scripts that run it',
         appliesTo: ['ESLint'],
-        outputs: ['eslint.config.mjs'],
+        outputs: ['eslint.config.mjs', 'package.json (scripts)'],
         canFixDrift: true,
         async run({ targetDir, pkg }) {
             await generateESLintConfig(inferProjectConfig(pkg), targetDir);
-            return { filesWritten: ['eslint.config.mjs'] };
+            const filesWritten = ['eslint.config.mjs'];
+            // Without `lint` the generated CI drops its lint step and `fix verify`
+            // composes a chain with no linting in it at all (#371).
+            if (await ensureScripts(targetDir, ESLINT_SCRIPTS))
+                filesWritten.push('package.json');
+            return { filesWritten };
         },
     },
     {
         target: 'prettier',
-        description: 'Scaffold prettier.config.mjs re-exporting the preset',
+        description: 'Scaffold prettier.config.mjs re-exporting the preset, plus the `format` script',
         appliesTo: ['Prettier'],
-        outputs: ['prettier.config.mjs'],
+        outputs: ['prettier.config.mjs', 'package.json (scripts)'],
         canFixDrift: true,
         async run({ targetDir }) {
             await generatePrettierConfig(targetDir);
-            return { filesWritten: ['prettier.config.mjs'] };
+            const filesWritten = ['prettier.config.mjs'];
+            if (await ensureScripts(targetDir, PRETTIER_SCRIPTS))
+                filesWritten.push('package.json');
+            return { filesWritten };
         },
     },
     {
@@ -459,14 +477,22 @@ export const FIXERS = [
     },
     {
         target: 'engines',
-        description: 'Add engines.node to package.json',
-        appliesTo: ['engines.node'],
-        outputs: ['package.json (engines.node field)'],
+        description: 'Add engines.node and packageManager to package.json',
+        appliesTo: ['engines.node', 'packageManager'],
+        outputs: ['package.json (engines.node + packageManager fields)'],
         riskLevel: 'safe-merge',
         canFixDrift: true,
-        async run({ targetDir }) {
-            const result = await ensureEnginesNode(targetDir);
-            return { filesWritten: result === 'added' ? ['package.json'] : [] };
+        async run({ targetDir, pkg }) {
+            // Same concern as engines.node — declaring the toolchain the repo
+            // expects. `fix github-actions` also pins it, but only reaches repos
+            // whose ci.yml is already drifted (#372). Guarded on pnpm because the
+            // value we write is a pnpm range; an npm or yarn repo must not get one.
+            const engines = await ensureEnginesNode(targetDir);
+            const manager = (await usesPnpm(targetDir, pkg))
+                ? await ensurePackageManager(targetDir)
+                : 'already-set';
+            const changed = engines === 'added' || manager === 'added';
+            return { filesWritten: changed ? ['package.json'] : [] };
         },
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.7.4",
+	"version": "3.8.1",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [