@safetnsr/vet 1.22.0 → 1.23.0

package/README.md

@@ -127,6 +127,8 @@ catch problems as the agent creates them, not after it's done.
 
 ## CI/CD
 
+### Quick (one-liner)
+
 ```yaml
 # .github/workflows/vet.yml
 name: vet
@@ -141,7 +143,43 @@ jobs:
       - run: npx @safetnsr/vet --ci
 ```
 
-GitHub Action: [`safetnsr/vet-action`](https://github.com/safetnsr/vet-action) (coming soon)
+### GitHub Action (with PR comments)
+
+Posts a score card directly on your PR with pass/fail status:
+
+```yaml
+name: vet
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  vet:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: safetnsr/vet/.github/actions/vet@main
+        with:
+          threshold: C        # minimum grade to pass (A/B/C/D/F)
+          comment: true        # post score card as PR comment
+```
+
+**Inputs:**
+
+| Input | Default | Description |
+|-------|---------|-------------|
+| `threshold` | `C` | Minimum grade to pass |
+| `working-directory` | `.` | Directory to run vet in |
+| `version` | `latest` | @safetnsr/vet version |
+| `comment` | `true` | Post results as PR comment |
+
+**Outputs:** `score`, `grade`, `passed`
 
 ## config
 

package/dist/checks/scan.js

@@ -156,6 +156,7 @@ function isInCodeContext(lines, lineIndex) {
 function isWorkflowFile(relPath) {
     const normalized = relPath.replace(/\\/g, '/');
     return normalized.includes('.github/workflows/') ||
+        normalized.includes('.github/actions/') ||
         normalized.includes('.circleci/') ||
         normalized.includes('.gitlab-ci') ||
         /Makefile|Dockerfile|Jenkinsfile/i.test(normalized);

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { resolve } from 'node:path';
 import { readFileSync } from 'node:fs';
-import { isGitRepo, readFile, c } from './util.js';
+import { isGitRepo, readFile, c, gitExec } from './util.js';
 import { checkReady } from './checks/ready.js';
 import { checkDiff } from './checks/diff.js';
 import { checkModels } from './checks/models.js';
@@ -35,6 +35,7 @@ import { checkContext, runContextCommand } from './checks/context.js';
 import { checkSplit, runSplitCommand } from './checks/split.js';
 import { checkCompleteness } from './checks/completeness.js';
 import { score } from './scorer.js';
+import { toGrade } from './categories.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 import { clearCache } from './file-cache.js';
 const args = process.argv.slice(2);
@@ -105,6 +106,7 @@ if (flags.has('--help') || flags.has('-h')) {
     --hook        pre-commit hook mode (exit 1 if below grade C)
     --badge       print markdown badge string and exit
     --fix         auto-fix configs, models
+    --diff-only   only score files changed in current branch (great for CI)
     --since REF   diff against specific commit/range
     --watch       re-run on file changes
     --json        JSON output
@@ -133,6 +135,7 @@ const isHook = flags.has('--hook');
 const isFix = flags.has('--fix');
 const isWatch = flags.has('--watch');
 const isBadge = flags.has('--badge');
+const isDiffOnly = flags.has('--diff-only');
 const isJSON = flags.has('--json') || (!process.stdout.isTTY && !flags.has('--pretty') && !isBadge);
 const since = flagMap.get('since');
 const maxFiles = flagMap.has('max-files') ? (parseInt(flagMap.get('max-files'), 10) || 0) : 0;
@@ -339,6 +342,56 @@ async function withTimeout(name, fn, timeoutMs = 30_000) {
         Promise.resolve(fn()).then((r) => { clearTimeout(timer); res(r); }).catch(() => { clearTimeout(timer); res({ name, score: 100, maxScore: 100, issues: [], summary: 'check failed' }); });
     });
 }
+/** Get files changed vs main/master branch or --since ref */
+function getChangedFiles(cwd, sinceRef) {
+    const base = sinceRef || (() => {
+        const main = gitExec(['merge-base', 'HEAD', 'origin/main'], cwd);
+        if (main)
+            return main;
+        const master = gitExec(['merge-base', 'HEAD', 'origin/master'], cwd);
+        if (master)
+            return master;
+        return 'HEAD~1';
+    })();
+    const output = gitExec(['diff', '--name-only', base, 'HEAD'], cwd);
+    if (!output)
+        return new Set();
+    return new Set(output.split('\n').filter(Boolean));
+}
+/** Filter VetResult to only include issues from changed files, then re-score */
+function filterDiffOnly(result, changedFiles) {
+    if (changedFiles.size === 0)
+        return result;
+    const filtered = {
+        ...result,
+        categories: result.categories.map(cat => {
+            const filteredChecks = cat.checks.map(check => {
+                const filteredIssues = check.issues.filter(issue => !issue.file || changedFiles.has(issue.file));
+                const penalty = filteredIssues.reduce((sum, i) => {
+                    if (i.severity === 'error')
+                        return sum + 25;
+                    if (i.severity === 'warning')
+                        return sum + 10;
+                    return sum + 2;
+                }, 0);
+                const newScore = Math.max(0, 100 - penalty);
+                return { ...check, score: newScore, issues: filteredIssues };
+            });
+            const allIssues = filteredChecks.flatMap(c => c.issues);
+            const checksWithIssues = filteredChecks.filter(c => c.issues.length > 0);
+            const avgScore = checksWithIssues.length > 0
+                ? Math.round(checksWithIssues.reduce((sum, c) => sum + c.score, 0) / checksWithIssues.length)
+                : 100;
+            return { ...cat, checks: filteredChecks, issues: allIssues, score: avgScore };
+        }),
+    };
+    const totalWeight = filtered.categories.reduce((sum, c) => sum + c.weight, 0);
+    filtered.score = Math.round(filtered.categories.reduce((sum, c) => sum + c.score * c.weight, 0) / totalWeight);
+    filtered.grade = toGrade(filtered.score);
+    filtered.totalIssues = filtered.categories.reduce((sum, c) => c.issues.length + sum, 0);
+    filtered.fixableIssues = filtered.categories.reduce((sum, c) => c.issues.filter(i => i.fixable).length + sum, 0);
+    return filtered;
+}
 async function runChecks() {
     const globalStart = Date.now();
     const GLOBAL_TIMEOUT = 120_000;
@@ -454,7 +507,11 @@ if (isWatch) {
 else {
     // Normal run
     try {
-        const result = await runChecks();
+        let result = await runChecks();
+        if (isDiffOnly) {
+            const changedFiles = getChangedFiles(cwd, since);
+            result = filterDiffOnly(result, changedFiles);
+        }
         if (isJSON) {
             console.log(reportJSON(result));
         }

package/dist/utils-bad.d.ts

@@ -0,0 +1 @@
+export declare function bad(): void;

package/dist/utils-bad.js

@@ -0,0 +1,6 @@
+const SECRET = "sk-abc123456789";
+// TODO: remove this hack
+export function bad() { try {
+    throw new Error();
+}
+catch (e) { } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {