@stll/oxlint-config 1.0.0 → 1.0.2

package/README.md

@@ -70,6 +70,11 @@ Bun, TypeScript install layouts, Node, Python, Rust, GitHub Actions, and
 Dependabot. Inherit the fields for tools your repository uses. The checker
 does not require tools absent from the repository.
 
+Shared-pin Dependabot ignores must contain only `dependency-name` and
+`update-types`, listing `version-update:semver-major`,
+`version-update:semver-minor`, and `version-update:semver-patch`. This ignores
+version updates while preserving security update pull requests.
+
 Set `packageManager` to `bun@` followed by the policy's `bun` value, and pin
 `bun-types` to that same value. Dependency pins can live in default or named
 catalogs, including Bun's `workspaces` catalogs. Bun image tags, version

package/dist/consumer-compat-cli.cjs

@@ -7,11 +7,11 @@ let node_child_process = require("node:child_process");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let semver = require("semver");
+let node_os = require("node:os");
 let yaml = require("yaml");
 let node_util = require("node:util");
 let node_fs_promises = require("node:fs/promises");
 let node_module = require("node:module");
-let node_os = require("node:os");
 let acorn = require("acorn");
 let node_crypto = require("node:crypto");
 //#region src/consumer-build-approvals.ts

package/dist/consumer-compat-cli.mjs

@@ -5,10 +5,10 @@ import { wrap } from "node:module";
 import { execFile, spawn } from "node:child_process";
 import path from "node:path";
 import { compare, satisfies, valid, validRange } from "semver";
+import { tmpdir } from "node:os";
 import { parse as parse$1, stringify } from "yaml";
 import { promisify } from "node:util";
 import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { parse as parse$2 } from "acorn";
 import { createHash } from "node:crypto";
 //#region src/consumer-build-approvals.ts

package/dist/git-tracked-output.cjs

@@ -0,0 +1,46 @@
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_os = require("node:os");
+//#region src/git-tracked-output.ts
+/** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */
+const readGitTrackedOutput = (root, mode) => {
+	const scratch = (0, node_fs.mkdtempSync)(node_path.default.join((0, node_os.tmpdir)(), "stll-git-tracked-"));
+	try {
+		const output = node_path.default.join(scratch, "tracked");
+		const descriptor = (0, node_fs.openSync)(output, "w", 384);
+		try {
+			(0, node_child_process.execFileSync)("git", [
+				"ls-files",
+				"-z",
+				...mode === "staged" ? ["--cached", "--stage"] : []
+			], {
+				cwd: root,
+				stdio: [
+					"ignore",
+					descriptor,
+					"inherit"
+				]
+			});
+		} finally {
+			(0, node_fs.closeSync)(descriptor);
+		}
+		return (0, node_fs.readFileSync)(output, "utf8");
+	} finally {
+		(0, node_fs.rmSync)(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+//#endregion
+Object.defineProperty(exports, "readGitTrackedOutput", {
+	enumerable: true,
+	get: function() {
+		return readGitTrackedOutput;
+	}
+});
+
+//# sourceMappingURL=git-tracked-output.cjs.map

package/dist/git-tracked-output.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-tracked-output.cjs","names":["path"],"sources":["../src/git-tracked-output.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport {\n  closeSync,\n  mkdtempSync,\n  openSync,\n  readFileSync,\n  rmSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\n/** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */\nexport const readGitTrackedOutput = (root: string, mode: \"paths\" | \"staged\") => {\n  const scratch = mkdtempSync(path.join(tmpdir(), \"stll-git-tracked-\"));\n  try {\n    const output = path.join(scratch, \"tracked\");\n    const descriptor = openSync(output, \"w\", 0o600);\n    try {\n      execFileSync(\n        \"git\",\n        [\n          \"ls-files\",\n          \"-z\",\n          ...(mode === \"staged\" ? [\"--cached\", \"--stage\"] : []),\n        ],\n        { cwd: root, stdio: [\"ignore\", descriptor, \"inherit\"] },\n      );\n    } finally {\n      closeSync(descriptor);\n    }\n    return readFileSync(output, \"utf8\");\n  } finally {\n    rmSync(scratch, { recursive: true, force: true });\n  }\n};\n"],"mappings":";;;;;;;;AAYA,MAAa,wBAAwB,MAAc,SAA6B;CAC9E,MAAM,WAAA,GAAA,QAAA,YAAA,CAAsBA,UAAAA,QAAK,MAAA,GAAA,QAAA,OAAA,CAAY,GAAG,mBAAmB,CAAC;CACpE,IAAI;EACF,MAAM,SAASA,UAAAA,QAAK,KAAK,SAAS,SAAS;EAC3C,MAAM,cAAA,GAAA,QAAA,SAAA,CAAsB,QAAQ,KAAK,GAAK;EAC9C,IAAI;GACF,CAAA,GAAA,mBAAA,aAAA,CACE,OACA;IACE;IACA;IACA,GAAI,SAAS,WAAW,CAAC,YAAY,SAAS,IAAI,CAAC;GACrD,GACA;IAAE,KAAK;IAAM,OAAO;KAAC;KAAU;KAAY;IAAS;GAAE,CACxD;EACF,UAAU;GACR,CAAA,GAAA,QAAA,UAAA,CAAU,UAAU;EACtB;EACA,QAAA,GAAA,QAAA,aAAA,CAAoB,QAAQ,MAAM;CACpC,UAAU;EACR,CAAA,GAAA,QAAA,OAAA,CAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAClD;AACF"}

package/dist/git-tracked-output.mjs

@@ -0,0 +1,39 @@
+import { closeSync, mkdtempSync, openSync, readFileSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { tmpdir } from "node:os";
+//#region src/git-tracked-output.ts
+/** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */
+const readGitTrackedOutput = (root, mode) => {
+	const scratch = mkdtempSync(path.join(tmpdir(), "stll-git-tracked-"));
+	try {
+		const output = path.join(scratch, "tracked");
+		const descriptor = openSync(output, "w", 384);
+		try {
+			execFileSync("git", [
+				"ls-files",
+				"-z",
+				...mode === "staged" ? ["--cached", "--stage"] : []
+			], {
+				cwd: root,
+				stdio: [
+					"ignore",
+					descriptor,
+					"inherit"
+				]
+			});
+		} finally {
+			closeSync(descriptor);
+		}
+		return readFileSync(output, "utf8");
+	} finally {
+		rmSync(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+//#endregion
+export { readGitTrackedOutput as t };
+
+//# sourceMappingURL=git-tracked-output.mjs.map

package/dist/git-tracked-output.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-tracked-output.mjs","names":[],"sources":["../src/git-tracked-output.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport {\n  closeSync,\n  mkdtempSync,\n  openSync,\n  readFileSync,\n  rmSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\n/** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */\nexport const readGitTrackedOutput = (root: string, mode: \"paths\" | \"staged\") => {\n  const scratch = mkdtempSync(path.join(tmpdir(), \"stll-git-tracked-\"));\n  try {\n    const output = path.join(scratch, \"tracked\");\n    const descriptor = openSync(output, \"w\", 0o600);\n    try {\n      execFileSync(\n        \"git\",\n        [\n          \"ls-files\",\n          \"-z\",\n          ...(mode === \"staged\" ? [\"--cached\", \"--stage\"] : []),\n        ],\n        { cwd: root, stdio: [\"ignore\", descriptor, \"inherit\"] },\n      );\n    } finally {\n      closeSync(descriptor);\n    }\n    return readFileSync(output, \"utf8\");\n  } finally {\n    rmSync(scratch, { recursive: true, force: true });\n  }\n};\n"],"mappings":";;;;;;AAYA,MAAa,wBAAwB,MAAc,SAA6B;CAC9E,MAAM,UAAU,YAAY,KAAK,KAAK,OAAO,GAAG,mBAAmB,CAAC;CACpE,IAAI;EACF,MAAM,SAAS,KAAK,KAAK,SAAS,SAAS;EAC3C,MAAM,aAAa,SAAS,QAAQ,KAAK,GAAK;EAC9C,IAAI;GACF,aACE,OACA;IACE;IACA;IACA,GAAI,SAAS,WAAW,CAAC,YAAY,SAAS,IAAI,CAAC;GACrD,GACA;IAAE,KAAK;IAAM,OAAO;KAAC;KAAU;KAAY;IAAS;GAAE,CACxD;EACF,UAAU;GACR,UAAU,UAAU;EACtB;EACA,OAAO,aAAa,QAAQ,MAAM;CACpC,UAAU;EACR,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAClD;AACF"}

package/dist/publish-contract-cli.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
+const require_git_tracked_output = require("./git-tracked-output.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
 const require_publish_contract = require("./publish-contract.cjs");
 const require_publish_build_target_vite_dts_helper = require("./publish-build-target-vite-dts-helper2.cjs");
@@ -9,8 +10,8 @@ let node_fs = require("node:fs");
 let node_child_process = require("node:child_process");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let node_module = require("node:module");
 let node_os = require("node:os");
+let node_module = require("node:module");
 let node_url = require("node:url");
 let acorn = require("acorn");
 let esbuild = require("esbuild");
@@ -921,10 +922,7 @@ const main = async () => {
 			node: policy.consumerNode,
 			typescript: policy.consumerTypescript
 		};
-		const tracked = (0, node_child_process.execFileSync)("git", ["ls-files", "-z"], {
-			cwd: root,
-			encoding: "utf8"
-		}).split("\0");
+		const tracked = require_git_tracked_output.readGitTrackedOutput(root, "paths").split("\0");
 		const files = {};
 		for (const file of tracked) {
 			if (file.split("/").some((part) => part === "node_modules" || part === ".git") || !["package.json", "pnpm-workspace.yaml"].includes(node_path.default.posix.basename(file)) && require_toolchain_inputs.githubAutomationFileKind(file) !== "workflow") continue;