@rtorcato/repo-tooling 3.8.0 → 3.8.2

package/dist/languages/js/checks.js

@@ -923,17 +923,74 @@ export function decidedBuilds(yaml) {
     return decided;
 }
 /**
- * Direct dependencies whose install would run a build script (#364).
+ * Package name encoded in a `node_modules/.pnpm` directory name (#373).
+ *
+ * Entries read `<name>@<version>` with `/` written as `+`, and the version may
+ * carry a peer suffix that contains further `@`s
+ * (`@babel+core@7.0.0_supports-color@8.0.0`), so the separator is the *first*
+ * `@` after index 0 — never the last.
+ */
+export function pnpmStoreDirToName(entry) {
+    const at = entry.indexOf('@', 1);
+    if (at < 1)
+        return null;
+    return entry.slice(0, at).replace('+', '/');
+}
+/**
+ * Transitive packages that ship a build script and have no decision (#373).
+ *
+ * One `package.json` read per unique name — never a recursive walk — and the
+ * whole pass is skipped when `.pnpm` is absent (npm/yarn repos, or nothing
+ * installed). `skip` drops the names the direct pass already owns.
+ */
+async function undecidedTransitiveBuilds(modulesDir, skip) {
+    const store = path.join(modulesDir, '.pnpm');
+    if (!(await fs.pathExists(store)))
+        return [];
+    const seen = new Set();
+    const undecided = new Set();
+    for (const entry of await fs.readdir(store)) {
+        const name = pnpmStoreDirToName(entry);
+        // A package present at two versions has two store dirs; report it once.
+        if (!name || seen.has(name) || skip(name))
+            continue;
+        seen.add(name);
+        // Store directory names come from registry metadata, and only the *first*
+        // `+` is decoded — the rest of the entry passes through literally, so a
+        // hostile name (`..+..@1.0.0` → `../..`) would climb out of the package
+        // directory and have `fs.readJson` read an unrelated file, whose `name`
+        // then lands in the report. Confirm the resolved path stays under this
+        // entry's `node_modules` before reading it.
+        const root = path.resolve(store, entry, 'node_modules');
+        const target = path.join(root, name, 'package.json');
+        if (!target.startsWith(root + path.sep))
+            continue;
+        let depPkg;
+        try {
+            depPkg = await fs.readJson(target);
+        }
+        catch {
+            continue;
+        }
+        const scripts = depPkg.scripts ?? {};
+        // `name` from the manifest is exact; the decoded dir name is the fallback.
+        if (BUILD_LIFECYCLE_SCRIPTS.some((s) => scripts[s]))
+            undecided.add(depPkg.name ?? name);
+    }
+    return [...undecided].filter((n) => !skip(n)).sort();
+}
+/**
+ * Dependencies whose install would run a build script (#364, #373).
  *
  * pnpm 11 turned undecided build scripts into a hard error, so
  * `pnpm install --frozen-lockfile` exits non-zero with ERR_PNPM_IGNORED_BUILDS
  * — a guaranteed CI failure. Locally the same message reads as advisory, which
  * is exactly why it gets missed until the pipeline goes red.
  *
- * Only direct dependencies are inspected: reaching transitive ones means
- * walking node_modules/.pnpm, and the packages that trip this in practice
- * (better-sqlite3, @prisma/client, esbuild) are ones the repo asked for by
- * name. A transitive offender is a false negative, never a false positive.
+ * Direct and transitive offenders are graded apart. A direct one is `drift`:
+ * the repo asked for the package by name and can answer for it. A transitive
+ * one is `optional-missing` — still worth recording, but common enough that
+ * grading it as drift would drown the report in noise.
  */
 export async function checkBuildApprovals(dir, pkg) {
     const check = 'pnpm build approvals';
@@ -964,13 +1021,19 @@ export async function checkBuildApprovals(dir, pkg) {
         if (BUILD_LIFECYCLE_SCRIPTS.some((s) => scripts[s]))
             undecided.push(name);
     }
-    if (undecided.length === 0) {
+    const transitive = await undecidedTransitiveBuilds(modulesDir, (name) => decided.has(name) || name in deps);
+    if (undecided.length === 0 && transitive.length === 0) {
         return { check, status: 'ok', detail: 'every dependency with a build script has a decision' };
     }
+    const parts = [];
+    if (undecided.length)
+        parts.push(`${undecided.length} dependenc${undecided.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${undecided.join(', ')}`);
+    if (transitive.length)
+        parts.push(`${transitive.length} transitive dependenc${transitive.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${transitive.join(', ')}`);
     return {
         check,
-        status: 'drift',
-        detail: `${undecided.length} dependenc${undecided.length === 1 ? 'y' : 'ies'} with undecided build scripts: ${undecided.join(', ')}`,
+        status: undecided.length ? 'drift' : 'optional-missing',
+        detail: parts.join('; '),
         hint: `Record a decision per package under \`allowBuilds:\` in ${WORKSPACE_FILE} (\`name: true\` to run it, \`false\` to skip). pnpm 11 fails \`pnpm install --frozen-lockfile\` outright while any is undecided, so CI cannot pass until each is answered.`,
     };
 }

package/dist/languages/js/fixers.js

@@ -28,6 +28,22 @@ const ESLINT_SCRIPTS = {
 const PRETTIER_SCRIPTS = {
     format: 'prettier --write .',
 };
+/** Kept in step with the knip line of getScripts() in package-json.ts. */
+const KNIP_SCRIPTS = {
+    knip: 'knip',
+};
+/** Kept in step with the typescript branch of getScripts() in package-json.ts. */
+const TSCONFIG_SCRIPTS = {
+    typecheck: 'tsc --noEmit',
+};
+// getScripts() also emits `test:ui`, but only the browser/both environments
+// install @vitest/ui, so a fixed-up repo would get a script it can't run.
+/** Kept in step with the vitest branch of getScripts() in package-json.ts. */
+const VITEST_SCRIPTS = {
+    test: 'vitest',
+    'test:watch': 'vitest --watch',
+    coverage: 'vitest run --coverage',
+};
 import { WORKSPACE_FILE, dependsOnEsbuild, ensurePnpmSettings, familyGlob, } from '../../cli/generators/pnpm-workspace.js';
 import { generatePostcss } from '../../cli/generators/postcss.js';
 import { generateCypressConfig, generateVitestConfig } from '../../cli/generators/testing.js';
@@ -150,13 +166,19 @@ export const FIXERS = [
     },
     {
         target: 'tsconfig',
-        description: 'Scaffold tsconfig.json extending the @rtorcato/repo-tooling preset',
+        description: 'Scaffold tsconfig.json extending the @rtorcato/repo-tooling preset, plus the `typecheck` script',
         appliesTo: ['TypeScript'],
-        outputs: ['tsconfig.json'],
+        outputs: ['tsconfig.json', 'package.json (scripts)'],
         canFixDrift: true,
         async run({ targetDir }) {
             const result = await copyPreset('tsconfig', targetDir);
-            return { filesWritten: [result.target] };
+            const filesWritten = [result.target];
+            // Without `typecheck` the generated CI drops its typecheck job entirely
+            // (#377). Shared with non-JS paths, so this is a no-op when there's no
+            // package.json to add it to.
+            if (await ensureScripts(targetDir, TSCONFIG_SCRIPTS))
+                filesWritten.push('package.json');
+            return { filesWritten };
         },
     },
     {
@@ -191,9 +213,9 @@ export const FIXERS = [
     },
     {
         target: 'vitest',
-        description: 'Scaffold vitest.config.ts (preserves vitest.setup.ts if present)',
+        description: 'Scaffold vitest.config.ts (preserves vitest.setup.ts if present), plus the scripts that run it',
         appliesTo: ['Vitest'],
-        outputs: ['vitest.config.ts'],
+        outputs: ['vitest.config.ts', 'package.json (scripts)'],
         canFixDrift: true,
         async run({ targetDir, pkg }) {
             const setupPath = path.join(targetDir, 'vitest.setup.ts');
@@ -203,7 +225,12 @@ export const FIXERS = [
             if (hadSetup && savedSetup !== null) {
                 await fs.writeFile(setupPath, savedSetup);
             }
-            return { filesWritten: ['vitest.config.ts'] };
+            const filesWritten = ['vitest.config.ts'];
+            // Without `coverage`/`test` the generated CI drops the whole test job,
+            // Codecov upload included (#377).
+            if (await ensureScripts(targetDir, VITEST_SCRIPTS))
+                filesWritten.push('package.json');
+            return { filesWritten };
         },
     },
     {
@@ -497,13 +524,18 @@ export const FIXERS = [
     },
     {
         target: 'knip',
-        description: 'Scaffold knip.json (entry globs matched to the package.json build model)',
+        description: 'Scaffold knip.json (entry globs matched to the package.json build model), plus the `knip` script',
         appliesTo: ['knip'],
-        outputs: ['knip.json'],
+        outputs: ['knip.json', 'package.json (scripts)'],
         canFixDrift: true,
         async run({ targetDir }) {
             await generateKnipConfig(targetDir);
-            return { filesWritten: ['knip.json'] };
+            const filesWritten = ['knip.json'];
+            // Without `knip` the generated CI drops its unused-code step, and with no
+            // check/lint script either the whole lint job disappears (#377).
+            if (await ensureScripts(targetDir, KNIP_SCRIPTS))
+                filesWritten.push('package.json');
+            return { filesWritten };
         },
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.8.0",
+	"version": "3.8.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [