@theholocron/astromech 5.0.0-alpha.152 → 5.0.0-alpha.153

package/README.md

@@ -230,3 +230,19 @@ Automated via semantic-release. See [CHANGELOG.md](../../CHANGELOG.md).
 ## Documentation
 
 <https://theholocron.github.io/holocron/>
+
+## Lint — `@theholocron/astromech/lint`
+
+The lint tools' own data and checks, in a subpath so the runner and the
+config surface don't pull `@commitlint/*` in:
+
+- `lintCommitMsgFile(file, cwd)` / `lintCommitMessage(message, config)` —
+  what `holocron run lint commit-msg <file>` (the `commit-msg` hook) runs.
+- `ALEX_CONFIG`, `ALEX_IGNORE_PATTERNS`, `PRETTIER_IGNORE_PATTERNS`,
+  `EDITORCONFIG_CHECKER_EXCLUDE` and `isEditorConfigExcluded(path)` — read
+  from the same templates `holocron repo setup` writes, so Sentinel's central
+  checks skip exactly what each repo's own CI skips.
+
+The root entry also exports the config-file generators `holocron repo setup`
+writes (`createEditorconfig`, `createAlexrc`, `createPrePush`, …) and
+`createHeader`.

package/dist/editorconfig-checker-DPejtR5z.mjs

@@ -0,0 +1,41 @@
+//#region src/templates/configs/alexjs/alexrc.json
+var alexrc_default = { allow: [
+	"dead",
+	"execute",
+	"execution",
+	"executes",
+	"failure",
+	"failures",
+	"hook",
+	"hooks",
+	"husky",
+	"period"
+] };
+//#endregion
+//#region src/templates/configs/editorconfig-checker/editorconfig-checker.json
+var editorconfig_checker_default = {
+	Verbose: false,
+	Format: "",
+	Debug: false,
+	IgnoreDefaults: false,
+	SpacesAfterTabs: false,
+	NoColor: false,
+	Exclude: [
+		"(^|.+/)LICENSE$",
+		"^public/.*",
+		"\\.md$",
+		"\\.mdx$"
+	],
+	AllowedContentTypes: [],
+	PassedFiles: [],
+	Disable: {
+		"EndOfLine": false,
+		"Indentation": false,
+		"InsertFinalNewline": false,
+		"TrimTrailingWhitespace": false,
+		"IndentSize": false,
+		"MaxLineLength": false
+	}
+};
+//#endregion
+export { alexrc_default as n, editorconfig_checker_default as t };

package/dist/index.d.mts

@@ -637,4 +637,139 @@ declare function matchNamespace(config: TasksConfig, namespace: string): string[
 //#region src/tasks/run/run.d.ts
 declare function runTask(input: RunTaskInput): RunTaskReport;
 //#endregion
-export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type DeployOnReleaseOptions, type DeployOnReleaseReport, type DeployOnReleaseResult, type ExecFn, type GroupJobReport, type GroupOptions, type GroupReport, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, type LocalRunner, type OrgContext, type PreviewConfig, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkspacePackage, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, matchNamespace, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runGroup, runTask };
+//#region src/templates/configs/alexjs/create-config.d.ts
+declare function createRcConfig(): string;
+declare function createIgnoreConfig(): string;
+//#endregion
+//#region src/templates/configs/commit-msg/create-config.d.ts
+/**
+ * `.husky/commit-msg` — lints the commit message via `holocron run lint
+ * commit-msg` (holocron#789), the real programmatic replacement for
+ * shelling out to `commitlint --edit`. Installed by `holocron repo setup` when
+ * hooks are enabled. Same `__HOLOCRON_SCRIPT__` substitution as `pre-push`.
+ *
+ * @param holocronScript - the command that invokes the CLI. Defaults to
+ *   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
+ */
+declare function createConfig(holocronScript?: string): string;
+//#endregion
+//#region src/templates/configs/dependabot/create-config.d.ts
+declare function createConfig$1(): string;
+//#endregion
+//#region src/templates/configs/devmoji/create-config.d.ts
+declare function createConfig$2(): string;
+//#endregion
+//#region src/templates/configs/editorconfig/create-config.d.ts
+declare function createConfig$3(): string;
+//#endregion
+//#region src/templates/configs/editorconfig-checker/create-config.d.ts
+/**
+ * The generated `.editorconfig-checker.json`.
+ *
+ * Deliberately carries no `"Version"` key: editorconfig-checker treats it as a
+ * hard gate and exits non-zero the moment the running binary's version differs
+ * — which it does the instant a contributor's local install (Homebrew tracks
+ * latest) drifts from the version super-linter bundles in CI, breaking
+ * `holocron run lint` / the pre-push hook for everyone (#618). The config
+ * options here (`Exclude`, `Disable`) are stable across releases, so pinning
+ * buys nothing.
+ */
+declare function createConfig$4(): string;
+//#endregion
+//#region src/templates/configs/labeler/create-config.d.ts
+declare function createConfig$5(): string;
+//#endregion
+//#region src/templates/configs/pre-commit/create-config.d.ts
+/**
+ * `.husky/pre-commit` — runs GitLeaks (scoped to staged changes) and
+ * lint-staged before every commit. Installed by `holocron repo setup` when hooks
+ * are enabled (default for `protection: "strict"`). `git commit --no-verify`
+ * bypasses it.
+ *
+ * `gitleaks protect --staged` (not `gitleaks git`) is deliberate: the latter
+ * scans the entire commit history on every invocation, so once any false
+ * positive lands in a past commit — a fake test token, an example key in a
+ * doc — every future commit is permanently blocked, regardless of what's
+ * actually staged.
+ */
+declare function createConfig$6(): string;
+//#endregion
+//#region src/templates/configs/pre-push/create-config.d.ts
+/**
+ * `.husky/pre-push` — runs `holocron run ci` (the merge-gating checks, in CI order)
+ * before every push. Installed by `holocron repo setup` when hooks are enabled
+ * (default for `protection: "strict"`). `git push --no-verify` bypasses it.
+ *
+ * @param holocronScript - the command that invokes the CLI. Defaults to
+ *   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
+ */
+declare function createConfig$7(holocronScript?: string): string;
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/create-config.d.ts
+declare function createConfig$8(): string;
+//#endregion
+//#region src/templates/configs/yamllint/create-config.d.ts
+declare function createConfig$9(): string;
+declare function createIgnoreConfig$1(): string;
+//#endregion
+//#region src/utils/create-header.type.d.ts
+/** Comment style produced by workflowHeader. */
+type WorkflowHeaderFormat = "yaml" | "cjs" | "shebang";
+interface CreateHeaderOptions {
+  /** Path within theholocron/holocron that owns the file being generated. */
+  source: string;
+  /** CLI command that produces the file. Defaults to "holocron repo setup". */
+  tool?: string;
+  /** Set true only when writing to theholocron/.github itself. */
+  forPrimary?: boolean;
+}
+interface HeaderFunctions {
+  /**
+   * "AUTO-GENERATED — do not edit" header for files managed on every run.
+   *
+   * format:
+   *   "yaml"    — `# …` comment lines (YAML, text, ignore files)
+   *   "cjs"     — `/* … *\/` block comment (CommonJS modules)
+   *   "shebang" — `#!/bin/sh` on line 1, then yaml header (shell scripts)
+   */
+  workflowHeader(format?: WorkflowHeaderFormat): string;
+  /**
+   * "Scaffolded — edit this file freely" header for one-time generated files
+   * that the user is expected to take over (e.g. codecov.yml).
+   */
+  scaffoldHeader(): string;
+}
+//#endregion
+//#region src/utils/create-header.d.ts
+/**
+ * Factory that binds `source` and `tool` once and returns all header
+ * constructors for auto-generated files. Prefer this over passing source
+ * as a positional argument at every call site.
+ *
+ * @example
+ * const { workflowHeader, scaffoldHeader } = createHeader({
+ *   source: "packages/astromech/src/templates/configs/editorconfig/create-config.ts",
+ * });
+ *
+ * export function createConfig(): string {
+ *   return `${workflowHeader()}${body}`;
+ * }
+ *
+ * ## Which header to use
+ *
+ * | Function          | When to use                                        | User can edit? |
+ * |-------------------|----------------------------------------------------|----------------|
+ * | `workflowHeader`  | Files overwritten on every setup / sync-github run | No — "AUTO-GENERATED — do not edit" |
+ * | `scaffoldHeader`  | Files written once; user takes ownership after     | Yes — "Scaffolded — edit this file freely" |
+ *
+ * ## `workflowHeader` formats
+ *
+ * | Format              | Comment style          | Used for                                              |
+ * |---------------------|------------------------|-------------------------------------------------------|
+ * | `"yaml"` (default)  | `# …` lines            | YAML workflows, ignore files, `.editorconfig`, labeler|
+ * | `"cjs"`             | `/* … *\/` block       | CommonJS config files (`.cjs`)                        |
+ * | `"shebang"`         | `#!/bin/sh` + `# …`    | Shell scripts (`prepare-commit-msg`, hooks)           |
+ */
+declare function createHeader(options: CreateHeaderOptions): HeaderFunctions;
+//#endregion
+export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type CreateHeaderOptions, type DeployOnReleaseOptions, type DeployOnReleaseReport, type DeployOnReleaseResult, type ExecFn, type GroupJobReport, type GroupOptions, type GroupReport, type HeaderFunctions, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, type LocalRunner, type OrgContext, type PreviewConfig, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkflowHeaderFormat, type WorkspacePackage, codecovComponentBlock, codecovConfig, createIgnoreConfig as createAlexignore, createRcConfig as createAlexrc, createAstromech, createCodecovConfig, createConfig as createCommitMsg, createConfig$1 as createDependabot, createConfig$2 as createDevmoji, createConfig$3 as createEditorconfig, createConfig$4 as createEditorconfigChecker, createHeader, createConfig$5 as createLabeler, createConfig$6 as createPreCommit, createConfig$7 as createPrePush, createConfig$8 as createPrepareCommitMsg, createTsconfig, createIgnoreConfig$1 as createYamlignore, createConfig$9 as createYamllint, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, matchNamespace, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runGroup, runTask };

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-ToVjaKPr.mjs";
+import { n as alexrc_default, t as editorconfig_checker_default } from "./editorconfig-checker-DPejtR5z.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dependencyNames, detectPackageManager, listWorkspacePackagesSync, readPackageJsonSync } from "@theholocron/pkg-utils";
 import { stringifyJson } from "@theholocron/json-utils";
@@ -2348,4 +2349,214 @@ async function deployOnRelease(options, { run = defaultRun, readJson = defaultRe
 	};
 }
 //#endregion
-export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, matchNamespace, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runGroup, runTask };
+//#region src/utils/create-header.ts
+/**
+* Factory that binds `source` and `tool` once and returns all header
+* constructors for auto-generated files. Prefer this over passing source
+* as a positional argument at every call site.
+*
+* @example
+* const { workflowHeader, scaffoldHeader } = createHeader({
+*   source: "packages/astromech/src/templates/configs/editorconfig/create-config.ts",
+* });
+*
+* export function createConfig(): string {
+*   return `${workflowHeader()}${body}`;
+* }
+*
+* ## Which header to use
+*
+* | Function          | When to use                                        | User can edit? |
+* |-------------------|----------------------------------------------------|----------------|
+* | `workflowHeader`  | Files overwritten on every setup / sync-github run | No — "AUTO-GENERATED — do not edit" |
+* | `scaffoldHeader`  | Files written once; user takes ownership after     | Yes — "Scaffolded — edit this file freely" |
+*
+* ## `workflowHeader` formats
+*
+* | Format              | Comment style          | Used for                                              |
+* |---------------------|------------------------|-------------------------------------------------------|
+* | `"yaml"` (default)  | `# …` lines            | YAML workflows, ignore files, `.editorconfig`, labeler|
+* | `"cjs"`             | `/* … *\/` block       | CommonJS config files (`.cjs`)                        |
+* | `"shebang"`         | `#!/bin/sh` + `# …`    | Shell scripts (`prepare-commit-msg`, hooks)           |
+*/
+function createHeader(options) {
+	const { source, tool = "holocron repo setup", forPrimary = false } = options;
+	const doNotEdit = forPrimary ? `AUTO-GENERATED — do not edit in theholocron/.github directly.` : `AUTO-GENERATED — do not edit directly.`;
+	return {
+		workflowHeader(format = "yaml") {
+			if (format === "cjs") return [
+				`/* ${doNotEdit}`,
+				` * Source:  theholocron/holocron · ${source}`,
+				` * Tool:    ${tool}`,
+				` * Changes: edit source in theholocron/holocron`,
+				` */`,
+				``
+			].join("\n");
+			const yamlLines = [
+				`# ${doNotEdit}`,
+				`# Source:  theholocron/holocron · ${source}`,
+				`# Tool:    ${tool}`,
+				`# Changes: edit source in theholocron/holocron`,
+				``
+			].join("\n");
+			if (format === "shebang") return `#!/bin/sh\n\n${yamlLines}`;
+			return yamlLines;
+		},
+		scaffoldHeader() {
+			return [
+				`# Scaffolded by holocron repo setup — edit this file freely.`,
+				`# Source:  theholocron/holocron · ${source}`,
+				``
+			].join("\n");
+		}
+	};
+}
+//#endregion
+//#region src/templates/configs/alexjs/alexignore
+var alexignore_default = ".github/*\nCHANGELOG.md\nLICENSE\n";
+//#endregion
+//#region src/templates/configs/alexjs/create-config.ts
+const { workflowHeader: workflowHeader$9 } = createHeader({ source: "packages/astromech/src/templates/configs/alexjs/create-config.ts" });
+function createRcConfig() {
+	return stringifyJson(alexrc_default);
+}
+function createIgnoreConfig() {
+	return `${workflowHeader$9()}${alexignore_default}`;
+}
+//#endregion
+//#region src/templates/configs/commit-msg/commit-msg
+var commit_msg_default = "__HOLOCRON_SCRIPT__ run lint commit-msg \"$1\"\n";
+//#endregion
+//#region src/templates/configs/commit-msg/create-config.ts
+const { workflowHeader: workflowHeader$8 } = createHeader({ source: "packages/astromech/src/templates/configs/commit-msg/create-config.ts" });
+/**
+* `.husky/commit-msg` — lints the commit message via `holocron run lint
+* commit-msg` (holocron#789), the real programmatic replacement for
+* shelling out to `commitlint --edit`. Installed by `holocron repo setup` when
+* hooks are enabled. Same `__HOLOCRON_SCRIPT__` substitution as `pre-push`.
+*
+* @param holocronScript - the command that invokes the CLI. Defaults to
+*   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
+*/
+function createConfig(holocronScript = "pnpm exec holocron") {
+	return `${workflowHeader$8("shebang")}${commit_msg_default.replace("__HOLOCRON_SCRIPT__", holocronScript)}`;
+}
+//#endregion
+//#region src/templates/configs/dependabot/dependabot.yml
+var dependabot_default = "version: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n      prefix-development: \"chore(deps-dev)\"\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/templates/configs/dependabot/create-config.ts
+const { workflowHeader: workflowHeader$7 } = createHeader({ source: "packages/astromech/src/templates/configs/dependabot/create-config.ts" });
+function createConfig$1() {
+	return `${workflowHeader$7()}${dependabot_default}`;
+}
+//#endregion
+//#region src/templates/configs/devmoji/create-config.ts
+const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/astromech/src/templates/configs/devmoji/create-config.ts" });
+function createConfig$2() {
+	return [
+		workflowHeader$6("cjs"),
+		`/* eslint-disable */`,
+		`const { defineConfig } = require("@theholocron/devmoji-config");`,
+		`module.exports = defineConfig();`,
+		``
+	].join("\n");
+}
+//#endregion
+//#region src/templates/configs/editorconfig/editorconfig
+var editorconfig_default = "root = true\n\n[*]\nend_of_line = lf\ncharset = utf-8\ntrim_trailing_whitespace = true\ninsert_final_newline = true\nindent_style = tab\nindent_size = 4\n\n[.gitattributes]\nindent_style = space\nindent_size = 2\n\n[*.{json,yml,yaml}]\nindent_style = space\nindent_size = 2\n\n[*.{md,mdx}]\ntrim_trailing_whitespace = false\nindent_style = unset\n\n[.*{rc,ignore}]\nindent_style = space\nindent_size = 2\n";
+//#endregion
+//#region src/templates/configs/editorconfig/create-config.ts
+const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/astromech/src/templates/configs/editorconfig/create-config.ts" });
+function createConfig$3() {
+	return `${workflowHeader$5()}${editorconfig_default}`;
+}
+//#endregion
+//#region src/templates/configs/editorconfig-checker/create-config.ts
+/**
+* The generated `.editorconfig-checker.json`.
+*
+* Deliberately carries no `"Version"` key: editorconfig-checker treats it as a
+* hard gate and exits non-zero the moment the running binary's version differs
+* — which it does the instant a contributor's local install (Homebrew tracks
+* latest) drifts from the version super-linter bundles in CI, breaking
+* `holocron run lint` / the pre-push hook for everyone (#618). The config
+* options here (`Exclude`, `Disable`) are stable across releases, so pinning
+* buys nothing.
+*/
+function createConfig$4() {
+	return stringifyJson(editorconfig_checker_default);
+}
+//#endregion
+//#region src/templates/configs/labeler/labeler.yml
+var labeler_default = "bug:\n  - \"^fix\"\n\nchore:\n  - '^chore(?!\\(deps)'\n\nci:\n  - \"^ci\"\n\ndependencies:\n  - '^chore\\(deps'\n\ndocumentation:\n  - \"^docs\"\n\nenhancement:\n  - \"^feat\"\n\nperformance:\n  - \"^perf\"\n\nrefactor:\n  - \"^refactor\"\n\ntest:\n  - \"^test\"\n";
+//#endregion
+//#region src/templates/configs/labeler/create-config.ts
+const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/astromech/src/templates/configs/labeler/create-config.ts" });
+function createConfig$5() {
+	return `${workflowHeader$4()}${labeler_default}`;
+}
+//#endregion
+//#region src/templates/configs/pre-commit/pre-commit
+var pre_commit_default = "# Run GitLeaks against staged changes only — a full `gitleaks git` history\n# scan re-flags every pre-existing (already-merged) finding on every commit,\n# permanently blocking the repo once any false positive lands in history.\n# CI's super-linter GITLEAKS validator is likewise scoped to changed files.\ngitleaks protect --staged --no-banner\n\n# Exit with non-zero if secrets are detected by GitLeaks\nif [ $? -ne 0 ]; then\n	echo \"Secrets detected by GitLeaks, aborting commit!\"\n	exit 1\nfi\n\n# Run lint-staged with a custom config\nnpx lint-staged --config @theholocron/lint-staged-config\n";
+//#endregion
+//#region src/templates/configs/pre-commit/create-config.ts
+const { workflowHeader: workflowHeader$3 } = createHeader({ source: "packages/astromech/src/templates/configs/pre-commit/create-config.ts" });
+/**
+* `.husky/pre-commit` — runs GitLeaks (scoped to staged changes) and
+* lint-staged before every commit. Installed by `holocron repo setup` when hooks
+* are enabled (default for `protection: "strict"`). `git commit --no-verify`
+* bypasses it.
+*
+* `gitleaks protect --staged` (not `gitleaks git`) is deliberate: the latter
+* scans the entire commit history on every invocation, so once any false
+* positive lands in a past commit — a fake test token, an example key in a
+* doc — every future commit is permanently blocked, regardless of what's
+* actually staged.
+*/
+function createConfig$6() {
+	return `${workflowHeader$3("shebang")}${pre_commit_default}`;
+}
+//#endregion
+//#region src/templates/configs/pre-push/pre-push
+var pre_push_default = "# Run the merge-gating checks locally before pushing — the same set CI runs.\n# Bypass once with:  git push --no-verify\n\n# CI runners (semantic-release, super-linter auto-commit, bots) push without a\n# built dev environment — the hook has nothing to add there.\n[ -n \"$CI\" ] && exit 0\n\n__HOLOCRON_SCRIPT__ run ci\n";
+//#endregion
+//#region src/templates/configs/pre-push/create-config.ts
+const { workflowHeader: workflowHeader$2 } = createHeader({ source: "packages/astromech/src/templates/configs/pre-push/create-config.ts" });
+/**
+* `.husky/pre-push` — runs `holocron run ci` (the merge-gating checks, in CI order)
+* before every push. Installed by `holocron repo setup` when hooks are enabled
+* (default for `protection: "strict"`). `git push --no-verify` bypasses it.
+*
+* @param holocronScript - the command that invokes the CLI. Defaults to
+*   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
+*/
+function createConfig$7(holocronScript = "pnpm exec holocron") {
+	return `${workflowHeader$2("shebang")}${pre_push_default.replace("__HOLOCRON_SCRIPT__", holocronScript)}`;
+}
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/prepare-commit-msg
+var prepare_commit_msg_default = "NAME=$(git config user.name)\nEMAIL=$(git config user.email)\n\nif [ -z \"$NAME\" ]; then\n	echo \"empty git config user.name\"\n	exit 1\nfi\n\nif [ -z \"$EMAIL\" ]; then\n	echo \"empty git config user.email\"\n	exit 1\nfi\n\ngit interpret-trailers --if-exists doNothing --trailer \\\n	\"Signed-off-by: $NAME <$EMAIL>\" \\\n	--in-place \"$1\"\n\n# --config <resolved shared path> (config-resolution workstream, #676) — falls\n# back to devmoji's own auto-discovery of a local devmoji.config.cjs when the\n# shared package's built dist/ isn't present (not installed, or a stale\n# install predating this file).\nDEVMOJI_CONFIG=\"node_modules/@theholocron/devmoji-config/dist/index.cjs\"\nif [ -f \"$DEVMOJI_CONFIG\" ]; then\n	npx devmoji --config \"$DEVMOJI_CONFIG\" -e\nelse\n	npx devmoji -e\nfi\n";
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/create-config.ts
+const { workflowHeader: workflowHeader$1 } = createHeader({ source: "packages/astromech/src/templates/configs/prepare-commit-msg/create-config.ts" });
+function createConfig$8() {
+	return `${workflowHeader$1("shebang")}${prepare_commit_msg_default}`;
+}
+//#endregion
+//#region src/templates/configs/yamllint/.yamlignore
+var _yamlignore_default = "pnpm-lock.yaml\n";
+//#endregion
+//#region src/templates/configs/yamllint/.yamllint.yml
+var _yamllint_default = "---\nextends: default\n\nignore-from-file:\n  - .gitignore\n  - .yamlignore\n\nrules:\n  comments:\n    min-spaces-from-content: 1\n    require-starting-space: true\n\n  comments-indentation: {}\n\n  document-start:\n    ignore: |\n      .github/*.yml\n\n  indentation:\n    spaces: consistent\n    indent-sequences: consistent\n\n  line-length: disable\n";
+//#endregion
+//#region src/templates/configs/yamllint/create-config.ts
+const { workflowHeader } = createHeader({ source: "packages/astromech/src/templates/configs/yamllint/create-config.ts" });
+function createConfig$9() {
+	return `${workflowHeader()}${_yamllint_default}`;
+}
+function createIgnoreConfig$1() {
+	return `${workflowHeader()}${_yamlignore_default}`;
+}
+//#endregion
+export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createIgnoreConfig as createAlexignore, createRcConfig as createAlexrc, createAstromech, createCodecovConfig, createConfig as createCommitMsg, createConfig$1 as createDependabot, createConfig$2 as createDevmoji, createConfig$3 as createEditorconfig, createConfig$4 as createEditorconfigChecker, createHeader, createConfig$5 as createLabeler, createConfig$6 as createPreCommit, createConfig$7 as createPrePush, createConfig$8 as createPrepareCommitMsg, createTsconfig, createIgnoreConfig$1 as createYamlignore, createConfig$9 as createYamllint, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, matchNamespace, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runGroup, runTask };

package/dist/lint/index.d.mts

@@ -0,0 +1,99 @@
+import { QualifiedConfig } from "@commitlint/types";
+//#region src/lint/alex-config.d.ts
+/**
+ * The org's canonical `alex` (inclusive-language) config, as raw parsed
+ * data rather than the pre-rendered file strings `createRcConfig()`/
+ * `createIgnoreConfig()` produce for `holocron repo setup` to write into a
+ * repo's own `.alexrc.json`/`.alexignore`.
+ *
+ * `.alexrc.json` is explicitly "generated by `holocron repo setup` — do not
+ * edit manually" (this repo's own `AGENTS.md`) — the real source of truth
+ * is this JSON file, one canonical copy, not each repo's synced one. A
+ * central Sentinel check (holocron#769/#793) reads it directly rather
+ * than fetching each repo's own copy via the Contents API — the same "one
+ * config, not N copies" reasoning `@theholocron/commitlint-config` already
+ * established for commit-message linting.
+ */
+declare const ALEX_CONFIG: {
+  allow: string[];
+};
+//#endregion
+//#region src/lint/alex-ignore-patterns.d.ts
+/**
+ * Glob-ish path patterns `alex` skips. Kept as a literal here rather than
+ * importing `../templates/configs/alexjs/alexignore` directly — that file
+ * (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
+ * the real filename `holocron repo setup` writes, which ECMAScript's own
+ * module resolution (`moduleResolution: "nodenext"`) can't import across
+ * a package boundary without an extension. Keep in sync with that file by
+ * hand; it changes rarely.
+ */
+declare const ALEX_IGNORE_PATTERNS: string[];
+//#endregion
+//#region src/lint/editorconfig-checker-exclude.d.ts
+/**
+ * The paths editorconfig-checker skips, read from the same
+ * `editorconfig-checker.json` template `holocron repo setup` writes as a repo's
+ * `.editorconfig-checker.json` — so Sentinel's central editorconfig check
+ * (holocron#927) excludes exactly what CI's editorconfig-checker does, from
+ * one source.
+ *
+ * The exclusion that matters most is `\.md$` / `\.mdx$`: the generated
+ * `.editorconfig` gives every file tab indentation, but
+ * `@theholocron/prettier-config` formats markdown with spaces, so a README's
+ * indented code example would fail one tool or the other. Markdown is left
+ * to prettier and markdownlint.
+ *
+ * Each entry is a regular-expression source, matched against a
+ * repo-relative path, as editorconfig-checker itself treats them.
+ */
+declare const EDITORCONFIG_CHECKER_EXCLUDE: readonly string[];
+//#endregion
+//#region src/lint/is-editorconfig-excluded.d.ts
+/** `true` when `path` matches any {@link EDITORCONFIG_CHECKER_EXCLUDE} pattern. */
+declare function isEditorConfigExcluded(path: string): boolean;
+//#endregion
+//#region src/lint/lint-message.type.d.ts
+interface CommitMessageViolation {
+  /** Rule name, e.g. `"subject-empty"`. */
+  rule: string;
+  /** commitlint's own message for the failure, e.g. `"subject may not be empty"`. */
+  message: string;
+}
+//#endregion
+//#region src/lint/lint-commit-msg-file.type.d.ts
+interface LintCommitMsgFileResult {
+  valid: boolean;
+  violations: CommitMessageViolation[];
+}
+//#endregion
+//#region src/lint/lint-commit-msg-file.d.ts
+declare function lintCommitMsgFile(filePath: string, cwd?: string): Promise<LintCommitMsgFileResult>;
+//#endregion
+//#region src/lint/lint-message.d.ts
+declare function lintCommitMessage(message: string, loaded: QualifiedConfig): Promise<CommitMessageViolation[]>;
+//#endregion
+//#region src/lint/prettier-ignore-patterns.d.ts
+/**
+ * The org's canonical prettier ignore-pattern list for a central Sentinel
+ * check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
+ * need a home here, since `@theholocron/prettier-config`'s default export
+ * already *is* one canonical, importable config (the same "one config,
+ * not N copies" reasoning `@theholocron/commitlint-config` established for
+ * commit-message linting, and `ALEX_CONFIG` established for inclusive
+ * language) — only the ignore list is a Sentinel-specific decision that
+ * belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
+ *
+ * Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
+ * `LICENSE` all independently confirmed to fail a real `prettier.check()`
+ * today — machine-generated or unparseable content, same reasoning that
+ * excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
+ * (alex never reads a lockfile, but prettier would try to reformat it):
+ * machine-written by pnpm's own writer, and not gitignored (lockfiles are
+ * tracked), so prettier picks it up by default. Reformatting it
+ * fights every subsequent `pnpm install` (this repo's own `.prettierignore`
+ * already excludes it for that exact reason).
+ */
+declare const PRETTIER_IGNORE_PATTERNS: string[];
+//#endregion
+export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, type CommitMessageViolation, EDITORCONFIG_CHECKER_EXCLUDE, type LintCommitMsgFileResult, PRETTIER_IGNORE_PATTERNS, isEditorConfigExcluded, lintCommitMessage, lintCommitMsgFile };

package/dist/lint/index.mjs

@@ -0,0 +1,143 @@
+import { n as alexrc_default, t as editorconfig_checker_default } from "../editorconfig-checker-DPejtR5z.mjs";
+import { readFile } from "node:fs/promises";
+import load from "@commitlint/load";
+import lint from "@commitlint/lint";
+//#region src/lint/alex-config.ts
+/**
+* The org's canonical `alex` (inclusive-language) config, as raw parsed
+* data rather than the pre-rendered file strings `createRcConfig()`/
+* `createIgnoreConfig()` produce for `holocron repo setup` to write into a
+* repo's own `.alexrc.json`/`.alexignore`.
+*
+* `.alexrc.json` is explicitly "generated by `holocron repo setup` — do not
+* edit manually" (this repo's own `AGENTS.md`) — the real source of truth
+* is this JSON file, one canonical copy, not each repo's synced one. A
+* central Sentinel check (holocron#769/#793) reads it directly rather
+* than fetching each repo's own copy via the Contents API — the same "one
+* config, not N copies" reasoning `@theholocron/commitlint-config` already
+* established for commit-message linting.
+*/
+const ALEX_CONFIG = alexrc_default;
+//#endregion
+//#region src/lint/alex-ignore-patterns.ts
+/**
+* Glob-ish path patterns `alex` skips. Kept as a literal here rather than
+* importing `../templates/configs/alexjs/alexignore` directly — that file
+* (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
+* the real filename `holocron repo setup` writes, which ECMAScript's own
+* module resolution (`moduleResolution: "nodenext"`) can't import across
+* a package boundary without an extension. Keep in sync with that file by
+* hand; it changes rarely.
+*/
+const ALEX_IGNORE_PATTERNS = [
+	".github/*",
+	"CHANGELOG.md",
+	"LICENSE"
+];
+//#endregion
+//#region src/lint/editorconfig-checker-exclude.ts
+/**
+* The paths editorconfig-checker skips, read from the same
+* `editorconfig-checker.json` template `holocron repo setup` writes as a repo's
+* `.editorconfig-checker.json` — so Sentinel's central editorconfig check
+* (holocron#927) excludes exactly what CI's editorconfig-checker does, from
+* one source.
+*
+* The exclusion that matters most is `\.md$` / `\.mdx$`: the generated
+* `.editorconfig` gives every file tab indentation, but
+* `@theholocron/prettier-config` formats markdown with spaces, so a README's
+* indented code example would fail one tool or the other. Markdown is left
+* to prettier and markdownlint.
+*
+* Each entry is a regular-expression source, matched against a
+* repo-relative path, as editorconfig-checker itself treats them.
+*/
+const EDITORCONFIG_CHECKER_EXCLUDE = editorconfig_checker_default.Exclude;
+//#endregion
+//#region src/lint/is-editorconfig-excluded.ts
+/** `true` when `path` matches any {@link EDITORCONFIG_CHECKER_EXCLUDE} pattern. */
+function isEditorConfigExcluded(path) {
+	return EDITORCONFIG_CHECKER_EXCLUDE.some((pattern) => new RegExp(pattern).test(path));
+}
+//#endregion
+//#region src/lint/lint-message.ts
+/**
+* Lints one commit message string against an already-loaded commitlint
+* config. The genuinely environment-independent half of commit-message
+* linting (holocron#789) — *obtaining* a `QualifiedConfig` differs by
+* caller (Sentinel isolates itself from any ambient config since it runs
+* standalone, away from a real repo checkout; `lintCommitMsgFile` below
+* lets cosmiconfig discover the invoking repo's own
+* `commitlint.config.*`, matching `commitlint --edit`'s own contract) —
+* but linting one message against a loaded config is identical either way.
+*
+* Real `@commitlint/lint` — the same programmatic API `@commitlint/cli`
+* itself uses internally — never a reimplementation of commitlint's rules.
+*/
+/** `parserPreset.parserOpts`, if the loaded config sets one — same lookup `@commitlint/cli`'s own `selectParserOpts()` does. */
+function selectParserOpts(parserPreset) {
+	return parserPreset?.parserOpts;
+}
+async function lintCommitMessage(message, loaded) {
+	const opts = {
+		/* istanbul ignore next -- see comment above */
+		parserOpts: selectParserOpts(loaded.parserPreset) ?? {},
+		plugins: loaded.plugins,
+		/* istanbul ignore next -- see comment above */
+		ignores: loaded.ignores ?? [],
+		defaultIgnores: loaded.defaultIgnores !== false
+	};
+	const outcome = await lint(message, loaded.rules, opts);
+	if (outcome.valid) return [];
+	return outcome.errors.map((error) => ({
+		rule: error.name,
+		message: error.message
+	}));
+}
+//#endregion
+//#region src/lint/lint-commit-msg-file.ts
+/**
+* `holocron run lint commit-msg <file>` — a real programmatic replacement for
+* shelling out to `commitlint --edit "$1"` from `.husky/commit-msg`
+* (holocron#789). Matches that CLI's own contract exactly: `file` is a
+* path to the commit message being written (the arg git's `commit-msg`
+* hook passes as `$1`), no `--config` override needed — `@commitlint/load`
+* runs from `cwd` with no seed, so cosmiconfig's own normal upward search
+* discovers the invoking repo's real `commitlint.config.*` file, exactly
+* as `commitlint --edit` (no `--config` flag) already does today. Unlike
+* Sentinel's `loadIsolatedConfig()`, no isolation is needed here — this
+* runs inside a real repo checkout with a real `node_modules`, not
+* standalone on a server.
+*/
+async function lintCommitMsgFile(filePath, cwd = process.cwd()) {
+	const violations = await lintCommitMessage(await readFile(filePath, "utf8"), await load({}, { cwd }));
+	return {
+		valid: violations.length === 0,
+		violations
+	};
+}
+//#endregion
+//#region src/lint/prettier-ignore-patterns.ts
+/**
+* The org's canonical prettier ignore-pattern list for a central Sentinel
+* check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
+* need a home here, since `@theholocron/prettier-config`'s default export
+* already *is* one canonical, importable config (the same "one config,
+* not N copies" reasoning `@theholocron/commitlint-config` established for
+* commit-message linting, and `ALEX_CONFIG` established for inclusive
+* language) — only the ignore list is a Sentinel-specific decision that
+* belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
+*
+* Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
+* `LICENSE` all independently confirmed to fail a real `prettier.check()`
+* today — machine-generated or unparseable content, same reasoning that
+* excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
+* (alex never reads a lockfile, but prettier would try to reformat it):
+* machine-written by pnpm's own writer, and not gitignored (lockfiles are
+* tracked), so prettier picks it up by default. Reformatting it
+* fights every subsequent `pnpm install` (this repo's own `.prettierignore`
+* already excludes it for that exact reason).
+*/
+const PRETTIER_IGNORE_PATTERNS = [...ALEX_IGNORE_PATTERNS, "pnpm-lock.yaml"];
+//#endregion
+export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, EDITORCONFIG_CHECKER_EXCLUDE, PRETTIER_IGNORE_PATTERNS, isEditorConfigExcluded, lintCommitMessage, lintCommitMsgFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/astromech",
-  "version": "5.0.0-alpha.152",
+  "version": "5.0.0-alpha.153",
   "description": "The Holocron task runner — one task manifest drives `holocron run`, `holocron run ci`, the CI workflows, package.json scripts, linters, and required checks.",
   "keywords": [
     "ci",
@@ -31,18 +31,28 @@
       "types": "./dist/config/index.d.mts",
       "import": "./dist/config/index.mjs",
       "default": "./dist/config/index.mjs"
+    },
+    "./lint": {
+      "types": "./dist/lint/index.d.mts",
+      "import": "./dist/lint/index.mjs",
+      "default": "./dist/lint/index.mjs"
     }
   },
   "files": [
     "dist"
   ],
   "dependencies": {
-    "@theholocron/fs-utils": "^1.13.0",
-    "@theholocron/json-utils": "^1.13.0",
-    "@theholocron/pkg-utils": "^1.13.0",
-    "@theholocron/datapad": "5.0.0-alpha.152"
+    "@commitlint/lint": "^21.2.3",
+    "@commitlint/load": "^21.2.3",
+    "@commitlint/types": "^21.2.3",
+    "@theholocron/fs-utils": "^1.15.1",
+    "@theholocron/json-utils": "^1.15.1",
+    "@theholocron/pkg-utils": "^1.15.1",
+    "@theholocron/datapad": "5.0.0-alpha.153"
   },
   "devDependencies": {
+    "@commitlint/config-conventional": "^21.2.3",
+    "@theholocron/commitlint-config": "^8.7.1",
     "@theholocron/eslint-config": "^8.7.1",
     "@theholocron/tsconfig": "^8.7.1",
     "@theholocron/tsdown-config": "^8.7.1",
@@ -56,7 +66,7 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.152"
+    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.153"
   },
   "engines": {
     "node": ">=22"