@stll/oxlint-config 1.0.0 → 1.0.1

package/README.md

@@ -70,6 +70,11 @@ Bun, TypeScript install layouts, Node, Python, Rust, GitHub Actions, and
 Dependabot. Inherit the fields for tools your repository uses. The checker
 does not require tools absent from the repository.
 
+Shared-pin Dependabot ignores must contain only `dependency-name` and
+`update-types`, listing `version-update:semver-major`,
+`version-update:semver-minor`, and `version-update:semver-patch`. This ignores
+version updates while preserving security update pull requests.
+
 Set `packageManager` to `bun@` followed by the policy's `bun` value, and pin
 `bun-types` to that same value. Dependency pins can live in default or named
 catalogs, including Bun's `workspaces` catalogs. Bun image tags, version

package/dist/toolchain-guard.cjs

@@ -12,7 +12,7 @@ picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let smol_toml = require("smol-toml");
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.0.0";
+const consumerRunnerVersion = "1.0.1";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -271,6 +271,12 @@ const sameStrings = (value, expected) => {
 	const sortedExpected = [...expected].sort();
 	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
 };
+const pinnedVersionUpdateTypes = [
+	"version-update:semver-major",
+	"version-update:semver-minor",
+	"version-update:semver-patch"
+];
+const versionOnlyIgnore = (entry) => record$6(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
 const directoryOf = (file) => {
 	const directory = node_path.default.posix.dirname(file);
 	return directory === "." ? "/" : `/${directory}`;
@@ -579,7 +585,8 @@ const checkDependabot = ({ files, policy }) => {
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
 		if (Array.isArray(ignore) && ignore.some((entry) => !record$6(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
 	}
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;