@stll/oxlint-config 1.0.0 → 1.0.2

package/dist/toolchain-guard.mjs

@@ -1,4 +1,5 @@
 import { _ as nodeSelectorMatches, a as isPythonDependencyManifest, c as pythonDependencyManifestKind, d as isComposeDefinitionPath, f as isKubernetesDefinitionPath, h as generateCloudSetup, i as isMiseConfigPath, l as toolchainInputKind, m as cloudSetupPath, n as isDependabotGithubActionsPath, o as isShellScript, p as workspaceContains, r as isDockerDefinitionPath, s as javascriptDependencyLockfiles, t as githubAutomationFileKind, u as containerDocumentImages, v as nodeSupportRangeMatches, y as parseCloudSetup } from "./toolchain-inputs.mjs";
+import { t as readGitTrackedOutput } from "./git-tracked-output.mjs";
 import { _ as parseConsumerFixtures, d as consumerPackageClosure, g as discoverConsumerPackages, i as assertConsumerFixtureKind, n as assertConsumerNodeSupport, o as assertConsumerFixtureSelection } from "./toolchain-schema.mjs";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
 import { execFileSync } from "node:child_process";
@@ -9,7 +10,7 @@ import picomatch from "picomatch";
 import { parse as parse$2 } from "smol-toml";
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.0.0";
+const consumerRunnerVersion = "1.0.2";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -268,6 +269,12 @@ const sameStrings = (value, expected) => {
 	const sortedExpected = [...expected].sort();
 	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
 };
+const pinnedVersionUpdateTypes = [
+	"version-update:semver-major",
+	"version-update:semver-minor",
+	"version-update:semver-patch"
+];
+const versionOnlyIgnore = (entry) => record$6(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
 const directoryOf = (file) => {
 	const directory = path.posix.dirname(file);
 	return directory === "." ? "/" : `/${directory}`;
@@ -576,7 +583,8 @@ const checkDependabot = ({ files, policy }) => {
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
 		if (Array.isArray(ignore) && ignore.some((entry) => !record$6(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
 	}
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;
@@ -3239,15 +3247,7 @@ const parseToolchainConfiguration = (input) => {
 /** Read one tracked configuration snapshot for guards and policy generation. */
 const readToolchainInputs = (root) => {
 	const diagnostics = [];
-	const tracked = execFileSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--stage"
-	], {
-		cwd: root,
-		encoding: "utf8"
-	}).split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
+	const tracked = readGitTrackedOutput(root, "staged").split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
 	const files = {};
 	const trackedFiles = new Set(tracked);
 	const resolvedRoot = realpathSync(root);