@shipi18n/cli 2.8.1 → 2.10.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @shipi18n/cli
 
+## 2.9.0
+
+- New: `check` now supports **Android `strings.xml`, gettext `.po`/`.pot`, and XLIFF 1.2/2.0** on top
+  of JSON, YAML, Flutter `.arb` and Apple `.xcstrings` — auto-detected from the input path (via core
+  2.9.0). The structural pass still needs no API key.
+
 ## 2.8.1
 
 - Security (hardening): pulls core 2.8.1 (translator prompt-injection guardrail + recursion depth

package/README.md

@@ -91,7 +91,8 @@ npx @shipi18n/cli check ./locales --source en
 ```
 
 It detects both common layouts (`locales/en.json` and `locales/en/<ns>.json`), plus Flutter ARB
-directories and Apple String Catalogs (`shipi18n check Localizable.xcstrings`).
+directories, Apple String Catalogs (`shipi18n check Localizable.xcstrings`), Android `res/values-*/`
+`strings.xml` trees, gettext `.po`/`.pot`, and XLIFF (`.xlf`/`.xliff`, 1.2 and 2.0).
 
 **What it catches:** missing and orphaned keys · dropped or invented placeholders (`{{name}}`,
 `{count}`, `%s`, `%1$s`, `%@`, `%lld`, `$t(...)`, `%{name}`, HTML tags) · collapsed vue-i18n pipe
@@ -103,12 +104,35 @@ plurals · empty values · untranslated copy · stale `.xcstrings` states.
 | `-r, --reporter <name>` | `human` | `human` \| `json` \| `sarif` \| `junit` |
 | `-o, --output <file>` | stdout | Write the report to a file |
 | `--ignore-keys <globs>` | — | Silence keys: `'*.copyright,home:mcp.badge'` |
+| `--severity <spec>` | — | Per-rule level override: `'untranslated=off,placeholder-added=error'` |
+| `--baseline <file>` | — | Fail only on findings NOT already in the baseline |
+| `--write-baseline` | — | Snapshot current findings into `--baseline` (default `.shipi18n/baseline.json`) and exit |
 | `--fail-on <level>` | `error` | `error` \| `warning` \| `none` |
 | `--min-coverage <pct>` | — | Fail any language below this coverage |
 
 Exit codes: `0` pass, `1` findings at the fail level, `2` usage error. Errors may fail CI; warnings
 never do by default — a warning that blocks PRs gets the tool uninstalled.
 
+### Adopting on a messy catalog — baseline & severity
+
+A linter that fails on 2,000 pre-existing findings gets uninstalled by lunch. Baseline first, then
+fail only on what's **new** — the Stylelint/RuboCop pattern:
+
+```bash
+# 1. Snapshot today's findings (commit the file).
+npx @shipi18n/cli check ./locales --baseline .shipi18n/baseline.json --write-baseline
+
+# 2. CI from now on fails only on NEW findings; the backlog is accepted.
+npx @shipi18n/cli check ./locales --baseline .shipi18n/baseline.json
+```
+
+The baseline keys each finding on `(language, namespace, key path, rule)` — not the message text, so
+rewording a message never invalidates it. A missing baseline file is a cold start (warn + report all),
+not an error. Burn the backlog down by re-running `--write-baseline` whenever it shrinks.
+
+`--severity` tunes or silences a rule everywhere: `error`, `warning`, `info` (reported, never fails),
+or `off` (dropped entirely). Example: `--severity 'untranslated=off,empty-value=warning'`.
+
 ### GitHub Actions with PR annotations
 
 ```yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipi18n/cli",
-  "version": "2.8.1",
+  "version": "2.10.0",
   "description": "Catch broken translations before you ship: dropped placeholders, missing keys, collapsed plurals and — with your own LLM key — mistranslations the structure checks cannot see. CI-ready (SARIF, JUnit, exit codes). Translates too.",
   "type": "module",
   "bin": {
@@ -49,7 +49,7 @@
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "ora": "^8.0.1",
-    "@shipi18n/core": "^2.8.1"
+    "@shipi18n/core": "^2.10.0"
   },
   "peerDependencies": {
     "@anthropic-ai/sdk": ">=0.30.0",

package/src/commands/check.js

@@ -7,8 +7,9 @@
  * pipeline can gate on it.
  *
  * Formats: plain JSON locale trees (flat `locales/<lang>.json` or nested
- * `locales/<lang>/<ns>.json`), Flutter ARB directories, and Apple String
- * Catalogs (`.xcstrings`). Reporters: human, json, sarif, junit.
+ * `locales/<lang>/<ns>.json`), YAML, Flutter ARB directories, Apple String
+ * Catalogs (`.xcstrings`), Android `strings.xml` trees, gettext `.po`/`.pot`,
+ * and XLIFF (`.xlf`/`.xliff`, 1.2 & 2.0). Reporters: human, json, sarif, junit.
  */
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs'
 import { resolve, dirname, join } from 'node:path'
@@ -23,6 +24,9 @@ import {
   aggregateLanguage,
   SEP,
   verdict,
+  applyPolicy,
+  buildBaseline,
+  parseSeverity,
 } from '@shipi18n/core'
 import { REPORTERS } from '../reporters.js'
 import { locksFor, DEFAULT_LOCKS_PATH } from './lock.js'
@@ -55,6 +59,9 @@ export function checkCommand(program) {
     .option('-o, --output <file>', 'Write the report to a file instead of stdout')
     .option('--json', 'Shorthand for --reporter json')
     .option('--ignore-keys <patterns>', "Comma-separated '*' globs of keys to silence (path or ns:path)")
+    .option('--severity <spec>', "Per-rule severity overrides, e.g. 'untranslated=off,placeholder-added=error' (error|warning|info|off)")
+    .option('--baseline <file>', 'Baseline file: findings already recorded in it do not fail the build (only NEW ones do)')
+    .option('--write-baseline', 'Snapshot current findings into --baseline (default .shipi18n/baseline.json) and exit')
     .option('--fail-on <level>', 'Exit non-zero on: error | warning | none', 'error')
     .option('--min-coverage <pct>', 'Fail any language below this coverage percentage', parseFloat)
     .option('--glossary <file>', 'Glossary JSON: DNT terms + locked per-language translations (deterministic)')
@@ -149,6 +156,62 @@ export function checkCommand(program) {
         }
       }
 
+      const DEFAULT_BASELINE = '.shipi18n/baseline.json'
+
+      // --write-baseline: snapshot every current finding and exit 0. Run after
+      // the (optional) semantic pass so a baseline can capture judge findings too.
+      if (opts.writeBaseline) {
+        const file = resolve(opts.baseline || DEFAULT_BASELINE)
+        const bl = buildBaseline(result)
+        try {
+          mkdirSync(dirname(file), { recursive: true })
+          writeFileSync(file, JSON.stringify(bl, null, 2) + '\n')
+        } catch (err) {
+          console.error(chalk.red(`Error: cannot write baseline ${file}: ${err.message}`))
+          process.exitCode = 2
+          return
+        }
+        console.error(chalk.gray(`baseline: recorded ${bl.count} finding(s) → ${opts.baseline || DEFAULT_BASELINE}`))
+        return
+      }
+
+      let severityMap
+      if (opts.severity) {
+        try {
+          severityMap = parseSeverity(opts.severity)
+        } catch (err) {
+          console.error(chalk.red(`Error: ${err.message}`))
+          process.exitCode = 2
+          return
+        }
+      }
+
+      let baseline
+      if (opts.baseline) {
+        const file = resolve(opts.baseline)
+        if (existsSync(file)) {
+          try {
+            baseline = JSON.parse(readFileSync(file, 'utf8'))
+          } catch (err) {
+            console.error(chalk.red(`Error: cannot read baseline ${opts.baseline}: ${err.message}`))
+            process.exitCode = 2
+            return
+          }
+        } else {
+          // A missing baseline is a cold start, not an error: nothing is suppressed
+          // and the run reports every finding. Hint how to create one.
+          console.error(chalk.yellow(`note: baseline ${opts.baseline} not found — reporting all findings. Create it with --write-baseline.`))
+        }
+      }
+
+      if (severityMap || baseline) {
+        const suppressed = applyPolicy(result, { severity: severityMap, baseline })
+        const parts = []
+        if (suppressed.suppressedByBaseline) parts.push(`${suppressed.suppressedByBaseline} baselined`)
+        if (suppressed.suppressedBySeverity) parts.push(`${suppressed.suppressedBySeverity} silenced (severity=off)`)
+        if (parts.length) console.error(chalk.gray(`policy: ${parts.join(', ')}`))
+      }
+
       const verdictResult = verdict(result, { failOn: opts.failOn, minCoverage: opts.minCoverage })
 
       const name = opts.json ? 'json' : opts.reporter