@verekia/warden 0.0.3 → 0.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verekia/warden",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Linter that checks repositories share consistent configs and tool versions.",
   "bin": {
     "warden": "./src/index.ts"
@@ -11,6 +11,8 @@
   "type": "module",
   "scripts": {
     "warden": "bun run src/index.ts",
+    "all-siblings": "bun run src/all-siblings.ts",
+    "ci-status": "bun run src/ci-status.ts",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
     "lint": "oxlint .",
@@ -34,13 +36,27 @@
       "../gputex",
       "../gradient-normal-textures",
       "../nanothree",
-      "../svg-to-tsl"
+      "../svg-to-msdf",
+      "../manalab",
+      "../tslfx",
+      "../polydraw",
+      "../r3f-gamedev",
+      "../webgamer",
+      "../voidcore",
+      "../jsblender"
     ],
     "checks": {
       "typecheckScript": {
         "modes": {
-          "gputex": "bun-filter-all",
-          "nanothree": "bun-filter-all"
+          "voidcore": "bun-filter-all"
+        }
+      },
+      "pinnedDependencyVersions": {
+        "exclude": {
+          "webgamer": [
+            "react",
+            "react-dom"
+          ]
         }
       }
     }

package/src/all-siblings.ts

@@ -0,0 +1,53 @@
+#!/usr/bin/env bun
+import { existsSync } from 'node:fs'
+
+import { loadConfig, resolveProjects } from './config.ts'
+
+const baseDir = process.cwd()
+
+const config = await loadConfig(baseDir)
+const allProjects = await resolveProjects(config, baseDir)
+
+const filterNames = process.argv.slice(2)
+const knownNames = new Set(allProjects.map(p => p.name))
+const unknown = filterNames.filter(n => !knownNames.has(n))
+if (unknown.length > 0) {
+  console.error(
+    `Unknown project(s): ${unknown.join(', ')}\nConfigured projects: ${allProjects.map(p => p.name).join(', ')}`,
+  )
+  process.exit(2)
+}
+
+const projects = filterNames.length > 0 ? allProjects.filter(p => filterNames.includes(p.name)) : allProjects
+
+const missing = projects.filter(p => !existsSync(p.path))
+if (missing.length > 0) {
+  const detail = missing.map(p => `  - ${p.name} (expected at ${p.path})`).join('\n')
+  const noun = missing.length === 1 ? 'directory is' : 'directories are'
+  console.error(`Cannot run all-siblings — the following project ${noun} not on disk:\n${detail}`)
+  process.exit(2)
+}
+
+console.log(
+  `all-siblings — running "bun run all" in ${projects.length} project(s): ${projects.map(p => p.name).join(', ')}`,
+)
+
+const failed: string[] = []
+for (const project of projects) {
+  console.log(`\n=== ${project.name} ===`)
+  const proc = Bun.spawn(['bun', 'run', 'all'], {
+    cwd: project.path,
+    stdout: 'inherit',
+    stderr: 'inherit',
+  })
+  const exitCode = await proc.exited
+  if (exitCode !== 0) {
+    failed.push(project.name)
+  }
+}
+
+console.log(`\n${projects.length - failed.length}/${projects.length} projects passed`)
+if (failed.length > 0) {
+  console.log(`Failed: ${failed.join(', ')}`)
+  process.exit(1)
+}

package/src/checks/ci-workflow.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, Project, WardenConfig } from '../types.ts'
 
 type Step = { run?: unknown }
 type Job = { steps?: unknown }
@@ -23,8 +23,7 @@ export const ciWorkflow = async (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['ciWorkflow']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   const file = options.file ?? DEFAULT_FILE
   const runs = options.runs ?? DEFAULT_RUNS
@@ -32,8 +31,7 @@ export const ciWorkflow = async (
   for (const project of projects) {
     const handle = Bun.file(`${project.path}/${file}`)
     if (!(await handle.exists())) {
-      passed = false
-      messages.push(`${project.name}: missing ${file}`)
+      findings.push({ project: project.name, message: `missing ${file}` })
       continue
     }
     if (!runs) continue
@@ -42,17 +40,15 @@ export const ciWorkflow = async (
     try {
       workflow = Bun.YAML.parse(await handle.text()) as Workflow
     } catch (err) {
-      passed = false
-      messages.push(`${project.name}: ${file} is not valid YAML (${(err as Error).message})`)
+      findings.push({ project: project.name, message: `${file} is not valid YAML (${(err as Error).message})` })
       continue
     }
 
     const commands = collectRunCommands(workflow)
     if (!commands.some(cmd => cmd.includes(runs))) {
-      passed = false
-      messages.push(`${project.name}: ${file} has no step running ${JSON.stringify(runs)}`)
+      findings.push({ project: project.name, message: `${file} has no step running ${JSON.stringify(runs)}` })
     }
   }
 
-  return { name: 'ciWorkflow', passed, messages }
+  return { name: 'ciWorkflow', findings }
 }

package/src/checks/config-files-present.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, Project, WardenConfig } from '../types.ts'
 
 const DEFAULT_FILES = ['.oxfmtrc.json', '.oxlintrc.json']
 
@@ -6,19 +6,17 @@ export const configFilesPresent = async (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['configFilesPresent']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   const files = options.files ?? DEFAULT_FILES
   for (const project of projects) {
     for (const file of files) {
       const exists = await Bun.file(`${project.path}/${file}`).exists()
       if (!exists) {
-        passed = false
-        messages.push(`${project.name}: missing ${file}`)
+        findings.push({ project: project.name, message: `missing ${file}` })
       }
     }
   }
 
-  return { name: 'configFilesPresent', passed, messages }
+  return { name: 'configFilesPresent', findings }
 }

package/src/checks/exact-dependency-versions.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
 
 const findVersion = (pkg: PackageJson, name: string): string | undefined =>
   pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]
@@ -14,40 +14,36 @@ export const exactDependencyVersions = (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['exactDependencyVersions']>,
 ): CheckResult => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   const packages = Object.entries(options.packages ?? DEFAULT_PACKAGES)
   if (packages.length === 0) {
-    return { name: 'exactDependencyVersions', passed, messages }
+    return { name: 'exactDependencyVersions', findings }
   }
 
   for (const project of projects) {
     if (!project.packageJson) {
-      passed = false
-      messages.push(`${project.name}: no package.json`)
+      findings.push({ project: project.name, message: 'no package.json' })
       continue
     }
     for (const [name, expected] of packages) {
       const declared = findVersion(project.packageJson, name)
       if (declared === undefined) {
-        passed = false
-        messages.push(`${project.name}: ${name} not declared (expected ${expected})`)
+        findings.push({ project: project.name, message: `${name} not declared (expected ${expected})` })
         continue
       }
       if (!EXACT_SEMVER.test(declared)) {
-        passed = false
-        messages.push(
-          `${project.name}: ${name} ${JSON.stringify(declared)} is not an exact version — use "${expected}"`,
-        )
+        findings.push({
+          project: project.name,
+          message: `${name} ${JSON.stringify(declared)} is not an exact version — use "${expected}"`,
+        })
         continue
       }
       if (declared !== expected) {
-        passed = false
-        messages.push(`${project.name}: ${name} ${declared} does not match expected ${expected}`)
+        findings.push({ project: project.name, message: `${name} ${declared} does not match expected ${expected}` })
       }
     }
   }
 
-  return { name: 'exactDependencyVersions', passed, messages }
+  return { name: 'exactDependencyVersions', findings }
 }

package/src/checks/matching-dependency-versions.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
 
 const findVersion = (pkg: PackageJson, name: string): string | undefined =>
   pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]
@@ -9,8 +9,7 @@ export const matchingDependencyVersions = (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['matchingDependencyVersions']>,
 ): CheckResult => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   for (const packageName of options.packages ?? DEFAULT_PACKAGES) {
     const versionToProjects = new Map<string, string[]>()
@@ -27,19 +26,26 @@ export const matchingDependencyVersions = (
       versionToProjects.set(version, existing)
     }
 
-    if (missing.length > 0) {
-      passed = false
-      messages.push(`${packageName}: not declared in ${missing.join(', ')}`)
+    for (const project of missing) {
+      findings.push({ project, message: `${packageName}: not declared` })
     }
 
     if (versionToProjects.size > 1) {
-      passed = false
-      const detail = [...versionToProjects.entries()]
-        .map(([version, names]) => `${version} (${names.join(', ')})`)
-        .join(' vs ')
-      messages.push(`${packageName}: version mismatch — ${detail}`)
+      const sorted = [...versionToProjects.entries()].toSorted((a, b) => b[1].length - a[1].length)
+      const [majority, ...rest] = sorted
+      if (majority) {
+        const [majorityVersion, majorityNames] = majority
+        for (const [version, names] of rest) {
+          for (const name of names) {
+            findings.push({
+              project: name,
+              message: `${packageName} ${version} mismatches majority ${majorityVersion} (${majorityNames.join(', ')})`,
+            })
+          }
+        }
+      }
     }
   }
 
-  return { name: 'matchingDependencyVersions', passed, messages }
+  return { name: 'matchingDependencyVersions', findings }
 }

package/src/checks/next-config.ts

@@ -1,7 +1,7 @@
 import { Glob } from 'bun'
 import { dirname, resolve } from 'node:path'
 
-import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
 
 const NEXT = 'next'
 const CONFIG_VARIANTS = ['next.config.js', 'next.config.mjs', 'next.config.ts', 'next.config.cjs'] as const
@@ -77,8 +77,7 @@ export const nextConfig = async (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['nextConfig']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   for (const project of projects) {
     const pkgs = await collectPackageJsons(project)
@@ -101,27 +100,26 @@ export const nextConfig = async (
       }
 
       if (configRel === null || configAbs === null) {
-        passed = false
-        messages.push(
-          `${project.name}/${relPath}: declares "next" but no config file found at ${dirLabel || './'} (expected one of ${CONFIG_VARIANTS.join(', ')})`,
-        )
+        findings.push({
+          project: project.name,
+          message: `${relPath}: declares "next" but no config file found at ${dirLabel || './'} (expected one of ${CONFIG_VARIANTS.join(', ')})`,
+        })
       } else {
         let cfg: Record<string, unknown> | null = null
         try {
           cfg = await loadConfigObject(configAbs)
         } catch (err) {
-          passed = false
-          messages.push(`${project.name}/${configRel}: failed to load — ${(err as Error).message}`)
+          findings.push({ project: project.name, message: `${configRel}: failed to load — ${(err as Error).message}` })
         }
 
         if (cfg) {
           for (const [key, expected] of Object.entries(options.options ?? DEFAULT_OPTIONS)) {
             if (!equal(cfg[key], expected)) {
-              passed = false
               const actual = key in cfg ? JSON.stringify(cfg[key]) : 'missing'
-              messages.push(
-                `${project.name}/${configRel}: "${key}" is ${actual} — expected ${JSON.stringify(expected)}`,
-              )
+              findings.push({
+                project: project.name,
+                message: `${configRel}: "${key}" is ${actual} — expected ${JSON.stringify(expected)}`,
+              })
             }
           }
         }
@@ -131,14 +129,14 @@ export const nextConfig = async (
         const declared = pkg.devDependencies?.[name]
         if (declared !== expected) {
           const actual = declared === undefined ? 'missing' : JSON.stringify(declared)
-          passed = false
-          messages.push(
-            `${project.name}/${relPath}: declares "next" but devDependencies["${name}"] is ${actual} — expected exact "${expected}" (must be declared in this package.json)`,
-          )
+          findings.push({
+            project: project.name,
+            message: `${relPath}: declares "next" but devDependencies["${name}"] is ${actual} — expected exact "${expected}" (must be declared in this package.json)`,
+          })
         }
       }
     }
   }
 
-  return { name: 'nextConfig', passed, messages }
+  return { name: 'nextConfig', findings }
 }

package/src/checks/pinned-dependency-versions.ts

@@ -0,0 +1,99 @@
+import { Glob } from 'bun'
+import { resolve } from 'node:path'
+
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
+
+const EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/
+
+const DEFAULT_PACKAGES: Record<string, string> = {
+  next: '16.2.6',
+  react: '19.2.6',
+  'react-dom': '19.2.6',
+  '@types/react': '19.2.14',
+  '@types/react-dom': '19.2.3',
+  tailwindcss: '4.3.0',
+  typescript: '6.0.3',
+  postcss: '8.5.14',
+  '@types/node': '25.7.0',
+}
+
+type WorkspaceField = string[] | { packages?: string[] } | undefined
+
+const workspacePatterns = (pkg: PackageJson | null): string[] => {
+  const ws = (pkg as { workspaces?: WorkspaceField } | null)?.workspaces
+  if (Array.isArray(ws)) return ws
+  if (ws && Array.isArray(ws.packages)) return ws.packages
+  return []
+}
+
+const collectPackageJsons = async (project: Project): Promise<Array<{ relPath: string; pkg: PackageJson }>> => {
+  const results: Array<{ relPath: string; pkg: PackageJson }> = []
+  if (project.packageJson) {
+    results.push({ relPath: 'package.json', pkg: project.packageJson })
+  }
+  for (const pattern of workspacePatterns(project.packageJson)) {
+    const target = `${pattern}/package.json`
+    if (pattern.includes('*')) {
+      const glob = new Glob(target)
+      for await (const path of glob.scan({ cwd: project.path, onlyFiles: true })) {
+        if (path.startsWith('node_modules/')) continue
+        const pkgFile = Bun.file(resolve(project.path, path))
+        if (await pkgFile.exists()) {
+          results.push({ relPath: path, pkg: (await pkgFile.json()) as PackageJson })
+        }
+      }
+    } else {
+      const pkgFile = Bun.file(resolve(project.path, target))
+      if (await pkgFile.exists()) {
+        results.push({ relPath: target, pkg: (await pkgFile.json()) as PackageJson })
+      }
+    }
+  }
+  return results
+}
+
+const DEP_GROUPS = ['dependencies', 'devDependencies', 'peerDependencies'] as const
+
+export const pinnedDependencyVersions = async (
+  projects: Project[],
+  options: NonNullable<NonNullable<WardenConfig['checks']>['pinnedDependencyVersions']>,
+): Promise<CheckResult> => {
+  const findings: Finding[] = []
+  const packages = Object.entries(options.packages ?? DEFAULT_PACKAGES)
+  if (packages.length === 0) {
+    return { name: 'pinnedDependencyVersions', findings }
+  }
+
+  for (const project of projects) {
+    const pkgs = await collectPackageJsons(project)
+    const excluded = new Set([
+      ...(options.exclude?.[project.name] ?? []),
+      ...(project.packageJson?.warden?.checks?.pinnedDependencyVersions?.exclude?.[project.name] ?? []),
+    ])
+
+    for (const { relPath, pkg } of pkgs) {
+      for (const [name, expected] of packages) {
+        if (excluded.has(name)) continue
+        for (const group of DEP_GROUPS) {
+          const declared = pkg[group]?.[name]
+          if (declared === undefined) continue
+          if (!EXACT_SEMVER.test(declared)) {
+            findings.push({
+              project: project.name,
+              message: `${relPath}: ${group}["${name}"] is ${JSON.stringify(declared)} — must be exact "${expected}"`,
+            })
+            continue
+          }
+          if (declared !== expected) {
+            findings.push({
+              project: project.name,
+              message: `${relPath}: ${group}["${name}"] is ${declared} — expected ${expected}`,
+            })
+          }
+        }
+      }
+    }
+  }
+
+  return { name: 'pinnedDependencyVersions', findings }
+}

package/src/checks/portless-next-dev.ts

@@ -1,7 +1,7 @@
 import { Glob } from 'bun'
 import { resolve } from 'node:path'
 
-import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
 
 const NEXT_DEV_RE = /\bnext dev\b/
 const PORTLESS_WRAP_RE = /\bportless\s+\S+\s+next dev\b/
@@ -46,8 +46,7 @@ export const portlessNextDev = async (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['portlessNextDev']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   for (const project of projects) {
     const pkgs = await collectPackageJsons(project)
@@ -60,10 +59,10 @@ export const portlessNextDev = async (
         if (!NEXT_DEV_RE.test(value)) continue
         usesNextDev = true
         if (!PORTLESS_WRAP_RE.test(value)) {
-          passed = false
-          messages.push(
-            `${project.name}/${relPath}: script "${name}" is ${JSON.stringify(value)} — must be wrapped as "portless <app-name> next dev"`,
-          )
+          findings.push({
+            project: project.name,
+            message: `${relPath}: script "${name}" is ${JSON.stringify(value)} — must be wrapped as "portless <app-name> next dev"`,
+          })
         }
       }
 
@@ -72,14 +71,14 @@ export const portlessNextDev = async (
         const declared = pkg.devDependencies?.portless
         if (declared !== expectedVersion) {
           const actual = declared === undefined ? 'missing' : JSON.stringify(declared)
-          passed = false
-          messages.push(
-            `${project.name}/${relPath}: uses "next dev" but devDependencies.portless is ${actual} — expected exact "${expectedVersion}" (must be declared in this package.json)`,
-          )
+          findings.push({
+            project: project.name,
+            message: `${relPath}: uses "next dev" but devDependencies.portless is ${actual} — expected exact "${expectedVersion}" (must be declared in this package.json)`,
+          })
         }
       }
     }
   }
 
-  return { name: 'portlessNextDev', passed, messages }
+  return { name: 'portlessNextDev', findings }
 }

package/src/checks/required-scripts.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, Project, WardenConfig } from '../types.ts'
 
 const DEFAULT_SCRIPTS: Record<string, string> = {
   format: 'oxfmt .',
@@ -11,34 +11,34 @@ export const requiredScripts = (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['requiredScripts']>,
 ): CheckResult => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   const required = Object.entries(options.scripts ?? DEFAULT_SCRIPTS)
   if (required.length === 0) {
-    return { name: 'requiredScripts', passed, messages }
+    return { name: 'requiredScripts', findings }
   }
 
   for (const project of projects) {
     const scripts = project.packageJson?.scripts
     if (!scripts) {
-      passed = false
-      messages.push(`${project.name}: no "scripts" in package.json`)
+      findings.push({ project: project.name, message: 'no "scripts" in package.json' })
       continue
     }
     for (const [name, expected] of required) {
       const actual = scripts[name]
       if (actual === undefined) {
-        passed = false
-        messages.push(`${project.name}: missing script "${name}" (expected ${JSON.stringify(expected)})`)
+        findings.push({
+          project: project.name,
+          message: `missing script "${name}" (expected ${JSON.stringify(expected)})`,
+        })
       } else if (actual !== expected) {
-        passed = false
-        messages.push(
-          `${project.name}: script "${name}" is ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
-        )
+        findings.push({
+          project: project.name,
+          message: `script "${name}" is ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
+        })
       }
     }
   }
 
-  return { name: 'requiredScripts', passed, messages }
+  return { name: 'requiredScripts', findings }
 }

package/src/checks/tailwind-oxfmt-config.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
 
 const TAILWIND = 'tailwindcss'
 const OXFMT_CONFIG = '.oxfmtrc.json'
@@ -13,8 +13,7 @@ export const tailwindOxfmtConfig = async (
   projects: Project[],
   _options: NonNullable<NonNullable<WardenConfig['checks']>['tailwindOxfmtConfig']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   for (const project of projects) {
     const oxfmtFile = Bun.file(`${project.path}/${OXFMT_CONFIG}`)
@@ -24,18 +23,20 @@ export const tailwindOxfmtConfig = async (
     const present = REQUIRED_KEY in oxfmt
 
     if (present && oxfmt[REQUIRED_KEY] !== true) {
-      passed = false
-      messages.push(
-        `${project.name}: ${OXFMT_CONFIG} "${REQUIRED_KEY}" must be \`true\` (got ${JSON.stringify(oxfmt[REQUIRED_KEY])})`,
-      )
+      findings.push({
+        project: project.name,
+        message: `${OXFMT_CONFIG} "${REQUIRED_KEY}" must be \`true\` (got ${JSON.stringify(oxfmt[REQUIRED_KEY])})`,
+      })
       continue
     }
 
     if (!present && project.packageJson && dependsOnTailwind(project.packageJson)) {
-      passed = false
-      messages.push(`${project.name}: depends on ${TAILWIND} but ${OXFMT_CONFIG} is missing "${REQUIRED_KEY}": true`)
+      findings.push({
+        project: project.name,
+        message: `depends on ${TAILWIND} but ${OXFMT_CONFIG} is missing "${REQUIRED_KEY}": true`,
+      })
     }
   }
 
-  return { name: 'tailwindOxfmtConfig', passed, messages }
+  return { name: 'tailwindOxfmtConfig', findings }
 }

package/src/checks/test-script-consistency.ts

@@ -1,6 +1,6 @@
 import { Glob } from 'bun'
 
-import type { CheckResult, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, Project, WardenConfig } from '../types.ts'
 
 const projectHasTests = async (projectPath: string, pattern: string): Promise<boolean> => {
   const glob = new Glob(pattern)
@@ -21,8 +21,7 @@ export const testScriptConsistency = async (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['testScriptConsistency']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   const testFilePattern = options.testFilePattern ?? DEFAULT_TEST_FILE_PATTERN
   const testScript = options.testScript ?? DEFAULT_TEST_SCRIPT
@@ -35,26 +34,26 @@ export const testScriptConsistency = async (
 
     if (hasTests) {
       if (scripts.test !== testScript) {
-        passed = false
-        messages.push(
-          `${project.name}: has test files but "test" script is ${JSON.stringify(scripts.test)}, expected ${JSON.stringify(testScript)}`,
-        )
+        findings.push({
+          project: project.name,
+          message: `has test files but "test" script is ${JSON.stringify(scripts.test)}, expected ${JSON.stringify(testScript)}`,
+        })
       }
       if (scripts.all !== allWithTests) {
-        passed = false
-        messages.push(
-          `${project.name}: "all" is ${JSON.stringify(scripts.all)}, expected ${JSON.stringify(allWithTests)} (project has tests)`,
-        )
+        findings.push({
+          project: project.name,
+          message: `"all" is ${JSON.stringify(scripts.all)}, expected ${JSON.stringify(allWithTests)} (project has tests)`,
+        })
       }
     } else {
       if (scripts.all !== allWithoutTests) {
-        passed = false
-        messages.push(
-          `${project.name}: "all" is ${JSON.stringify(scripts.all)}, expected ${JSON.stringify(allWithoutTests)} (no tests detected)`,
-        )
+        findings.push({
+          project: project.name,
+          message: `"all" is ${JSON.stringify(scripts.all)}, expected ${JSON.stringify(allWithoutTests)} (no tests detected)`,
+        })
       }
     }
   }
 
-  return { name: 'testScriptConsistency', passed, messages }
+  return { name: 'testScriptConsistency', findings }
 }

package/src/checks/typecheck-script.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, Project, WardenConfig } from '../types.ts'
 
 const SINGLE = 'tsc --noEmit'
 const SOLUTION = 'tsc -b --noEmit'
@@ -19,14 +19,12 @@ export const typecheckScript = async (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['typecheckScript']>,
 ): Promise<CheckResult> => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
 
   for (const project of projects) {
     const scripts = project.packageJson?.scripts
     if (!scripts) {
-      passed = false
-      messages.push(`${project.name}: no "scripts" in package.json`)
+      findings.push({ project: project.name, message: 'no "scripts" in package.json' })
       continue
     }
     const mode = options.modes?.[project.name] ?? 'auto'
@@ -38,15 +36,17 @@ export const typecheckScript = async (
         : `root tsconfig ${expected === SOLUTION ? 'has' : 'has no'} project references`
     const actual = scripts.typecheck
     if (actual === undefined) {
-      passed = false
-      messages.push(`${project.name}: missing script "typecheck" (expected ${JSON.stringify(expected)})`)
+      findings.push({
+        project: project.name,
+        message: `missing script "typecheck" (expected ${JSON.stringify(expected)})`,
+      })
     } else if (actual !== expected) {
-      passed = false
-      messages.push(
-        `${project.name}: script "typecheck" is ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)} (${reason})`,
-      )
+      findings.push({
+        project: project.name,
+        message: `script "typecheck" is ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)} (${reason})`,
+      })
     }
   }
 
-  return { name: 'typecheckScript', passed, messages }
+  return { name: 'typecheckScript', findings }
 }

package/src/checks/warden-script.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, PackageJson, Project, WardenConfig } from '../types.ts'
+import type { CheckResult, Finding, PackageJson, Project, WardenConfig } from '../types.ts'
 
 const dependsOn = (pkg: PackageJson, name: string): boolean =>
   name in (pkg.dependencies ?? {}) || name in (pkg.devDependencies ?? {}) || name in (pkg.peerDependencies ?? {})
@@ -9,8 +9,7 @@ export const wardenScript = (
   projects: Project[],
   options: NonNullable<NonNullable<WardenConfig['checks']>['wardenScript']>,
 ): CheckResult => {
-  const messages: string[] = []
-  let passed = true
+  const findings: Finding[] = []
   const packageName = options.package ?? DEFAULT_PACKAGE
 
   for (const project of projects) {
@@ -19,18 +18,18 @@ export const wardenScript = (
 
     const scripts = pkg.scripts ?? {}
     if (scripts.warden !== 'warden') {
-      passed = false
-      messages.push(
-        `${project.name}: depends on ${packageName} but "warden" script is ${JSON.stringify(scripts.warden)}, expected "warden"`,
-      )
+      findings.push({
+        project: project.name,
+        message: `depends on ${packageName} but "warden" script is ${JSON.stringify(scripts.warden)}, expected "warden"`,
+      })
     }
     if (!scripts.all || !scripts.all.includes('bun run warden')) {
-      passed = false
-      messages.push(
-        `${project.name}: depends on ${packageName} but "all" script ${JSON.stringify(scripts.all)} is missing "bun run warden"`,
-      )
+      findings.push({
+        project: project.name,
+        message: `depends on ${packageName} but "all" script ${JSON.stringify(scripts.all)} is missing "bun run warden"`,
+      })
     }
   }
 
-  return { name: 'wardenScript', passed, messages }
+  return { name: 'wardenScript', findings }
 }

package/src/ci-status.ts

@@ -0,0 +1,98 @@
+#!/usr/bin/env bun
+import { loadConfig, resolveProjects } from './config.ts'
+
+type Run = {
+  conclusion: string | null
+  status: string
+  workflowName: string
+  url: string
+  createdAt: string
+  headSha: string
+  event: string
+}
+
+const baseDir = process.cwd()
+
+const config = await loadConfig(baseDir)
+const allProjects = await resolveProjects(config, baseDir)
+
+const filterNames = process.argv.slice(2)
+const knownNames = new Set(allProjects.map(p => p.name))
+const unknown = filterNames.filter(n => !knownNames.has(n))
+if (unknown.length > 0) {
+  console.error(
+    `Unknown project(s): ${unknown.join(', ')}\nConfigured projects: ${allProjects.map(p => p.name).join(', ')}`,
+  )
+  process.exit(2)
+}
+
+const projects = filterNames.length > 0 ? allProjects.filter(p => filterNames.includes(p.name)) : allProjects
+
+console.log(
+  `ci-status — checking last main-branch run for ${projects.length} project(s): ${projects.map(p => p.name).join(', ')}`,
+)
+
+const failed: string[] = []
+const missing: string[] = []
+
+for (const project of projects) {
+  const repo = `verekia/${project.name}`
+  const proc = Bun.spawn(
+    [
+      'gh',
+      'run',
+      'list',
+      '--repo',
+      repo,
+      '--branch',
+      'main',
+      '--limit',
+      '1',
+      '--json',
+      'conclusion,status,workflowName,url,createdAt,headSha,event',
+    ],
+    { stdout: 'pipe', stderr: 'pipe' },
+  )
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+
+  if (exitCode !== 0) {
+    console.log(`\n[ERROR] ${project.name} (${repo})`)
+    console.log(stderr.trim() || `gh exited with code ${exitCode}`)
+    failed.push(project.name)
+    continue
+  }
+
+  const runs = JSON.parse(stdout) as Run[]
+  const run = runs[0]
+  if (!run) {
+    console.log(`\n[NONE]  ${project.name} — no workflow runs on main`)
+    missing.push(project.name)
+    continue
+  }
+
+  const verdict =
+    run.status !== 'completed'
+      ? `IN PROGRESS (${run.status})`
+      : run.conclusion === 'success'
+        ? 'PASS'
+        : `FAIL (${run.conclusion ?? 'unknown'})`
+  const tag = verdict === 'PASS' ? '[PASS]' : verdict.startsWith('IN PROGRESS') ? '[WAIT]' : '[FAIL]'
+
+  console.log(`\n${tag} ${project.name} — ${run.workflowName}: ${verdict}`)
+  console.log(`       ${run.createdAt}  ${run.headSha.slice(0, 7)}  ${run.event}`)
+  console.log(`       ${run.url}`)
+
+  if (tag === '[FAIL]') failed.push(project.name)
+}
+
+const passed = projects.length - failed.length - missing.length
+console.log(`\n${passed}/${projects.length} projects passed`)
+if (missing.length > 0) console.log(`No runs on main: ${missing.join(', ')}`)
+if (failed.length > 0) {
+  console.log(`Failed: ${failed.join(', ')}`)
+  process.exit(1)
+}

package/src/index.ts

@@ -6,6 +6,7 @@ import { configFilesPresent } from './checks/config-files-present.ts'
 import { exactDependencyVersions } from './checks/exact-dependency-versions.ts'
 import { matchingDependencyVersions } from './checks/matching-dependency-versions.ts'
 import { nextConfig } from './checks/next-config.ts'
+import { pinnedDependencyVersions } from './checks/pinned-dependency-versions.ts'
 import { portlessNextDev } from './checks/portless-next-dev.ts'
 import { requiredScripts } from './checks/required-scripts.ts'
 import { tailwindOxfmtConfig } from './checks/tailwind-oxfmt-config.ts'
@@ -59,6 +60,9 @@ if (enabled(checks.matchingDependencyVersions)) {
 if (enabled(checks.exactDependencyVersions)) {
   results.push(exactDependencyVersions(projects, checks.exactDependencyVersions ?? {}))
 }
+if (enabled(checks.pinnedDependencyVersions)) {
+  results.push(await pinnedDependencyVersions(projects, checks.pinnedDependencyVersions ?? {}))
+}
 if (enabled(checks.requiredScripts)) {
   results.push(requiredScripts(projects, checks.requiredScripts ?? {}))
 }
@@ -84,14 +88,35 @@ if (enabled(checks.ciWorkflow)) {
   results.push(await ciWorkflow(projects, checks.ciWorkflow ?? {}))
 }
 
+const findingsByProjectByCheck = new Map<string, Map<string, string[]>>()
 for (const result of results) {
-  const tag = result.passed ? '[PASS]' : '[FAIL]'
-  console.log(`${tag} ${result.name}`)
-  for (const message of result.messages) {
-    console.log(`       ${message}`)
+  for (const finding of result.findings) {
+    const byCheck = findingsByProjectByCheck.get(finding.project) ?? new Map<string, string[]>()
+    const list = byCheck.get(result.name) ?? []
+    list.push(finding.message)
+    byCheck.set(result.name, list)
+    findingsByProjectByCheck.set(finding.project, byCheck)
+  }
+}
+
+let failedProjects = 0
+for (const project of projects) {
+  const byCheck = findingsByProjectByCheck.get(project.name) ?? new Map<string, string[]>()
+  const projectFailed = byCheck.size > 0
+  if (projectFailed) failedProjects += 1
+  console.log(`${projectFailed ? '[FAIL]' : '[PASS]'} ${project.name}`)
+  for (const result of results) {
+    const messages = byCheck.get(result.name) ?? []
+    if (messages.length === 0) {
+      console.log(`       [PASS] ${result.name}`)
+    } else {
+      console.log(`       [FAIL] ${result.name}`)
+      for (const message of messages) {
+        console.log(`              ${message}`)
+      }
+    }
   }
 }
 
-const failed = results.filter(r => !r.passed).length
-console.log(`\n${results.length - failed}/${results.length} checks passed`)
-process.exit(failed === 0 ? 0 : 1)
+console.log(`\n${projects.length - failedProjects}/${projects.length} projects passed`)
+process.exit(failedProjects === 0 ? 0 : 1)

package/src/types.ts

@@ -4,6 +4,11 @@ export type WardenConfig = {
     configFilesPresent?: { enabled?: boolean; files?: string[] }
     matchingDependencyVersions?: { enabled?: boolean; packages?: string[] }
     exactDependencyVersions?: { enabled?: boolean; packages?: Record<string, string> }
+    pinnedDependencyVersions?: {
+      enabled?: boolean
+      packages?: Record<string, string>
+      exclude?: Record<string, string[]>
+    }
     requiredScripts?: { enabled?: boolean; scripts?: Record<string, string> }
     typecheckScript?: { enabled?: boolean; modes?: Record<string, 'auto' | 'bun-filter-all'> }
     testScriptConsistency?: {
@@ -32,6 +37,7 @@ export type PackageJson = {
   dependencies?: Record<string, string>
   devDependencies?: Record<string, string>
   peerDependencies?: Record<string, string>
+  warden?: WardenConfig
 }
 
 export type Project = {
@@ -40,8 +46,12 @@ export type Project = {
   packageJson: PackageJson | null
 }
 
+export type Finding = {
+  project: string
+  message: string
+}
+
 export type CheckResult = {
   name: string
-  passed: boolean
-  messages: string[]
+  findings: Finding[]
 }