@zgeoff/chex 0.1.9 → 0.2.0

package/README.md

@@ -94,7 +94,6 @@ extends:
   - node_modules/@zgeoff/chex/lefthook.yml
 ```
 
-The baseline's jobs call `chex <check>` for the repo checks, `bun run check:docs` for the docs
-checks the repo names, `rig related` for the tests beside the changed files, and the repo's own
-`format:check` and `typecheck` scripts.
+The baseline's jobs call `chex <check>`, `bun run check:docs`, `rig related` and the repo's own
+`format:check` and `typecheck` scripts. Each job's name starts with `chex-`.
 [The pre-push baseline](../../docs/architecture/pre-push-baseline.md) describes each job.

package/lefthook.yml

@@ -8,6 +8,8 @@
 # also runs typecheck before a commit that changes code or config, after the
 # repo's own pre-commit fixers. A repo adds its own jobs under
 # pre-commit.jobs and pre-push.jobs in lefthook.yml; they run before these.
+# lefthook 2.2.2 lets a job of an extended file replace the job of the same
+# name in lefthook.yml, so each job name here starts with chex-.
 # Each job runs under diet's memory cap, so a run that outgrows the host fails
 # alone, with its peak memory in the output. bun x --no-install runs the
 # repo's own install of chex, diet and rig, and fails when one is missing
@@ -28,7 +30,7 @@ pre-commit:
   piped: true
   jobs:
     # lefthook skips the job when no staged file matches the glob.
-    - name: typecheck
+    - name: chex-typecheck
       glob: '*.{js,mjs,cjs,jsx,ts,mts,cts,tsx,json,jsonc}'
       run: '{clear-git-env} bun x --no-install diet -- bun run typecheck'
 
@@ -39,13 +41,13 @@ pre-push:
     # The jobs after this one read the files on disk, so this one fails the
     # push when a file the branch changes or deletes holds a change that is
     # not committed, and names each such file.
-    - name: uncommitted
+    - name: chex-uncommitted
       run: '{clear-git-env} bun x --no-install diet -- bun x --no-install chex uncommitted'
-    - name: format:check
+    - name: chex-format:check
       run: '{clear-git-env} bun x --no-install diet -- bun run format:check'
     # Plain oxlint, without the unused-directive check: a directive for a
     # type-aware rule reads as unused in plain mode.
-    - name: lint
+    - name: chex-lint
       files:
         unset $(git rev-parse --local-env-vars); bun
         node_modules/@zgeoff/chex/src/read-branch-files.ts
@@ -57,7 +59,7 @@ pre-push:
     # glob, so a file the branch leaves unchanged never fails a push. A check
     # whose program the machine lacks prints a notice and passes: CI installs
     # the program and runs the check on every pull request.
-    - name: shell
+    - name: chex-shell
       files:
         unset $(git rev-parse --local-env-vars); bun
         node_modules/@zgeoff/chex/src/read-branch-files.ts
@@ -77,7 +79,7 @@ pre-push:
     # The docs checks pick the docs they read themselves, so the glob only
     # decides whether the job runs. The repo's check:docs script names the
     # checks it takes, such as chex prose length links.
-    - name: docs
+    - name: chex-docs
       files:
         unset $(git rev-parse --local-env-vars); bun
         node_modules/@zgeoff/chex/src/read-branch-files.ts
@@ -89,7 +91,7 @@ pre-push:
     # rhysd/actionlint#654 ships; the ignore lapses on the same date as in CI.
     # The workflow lint runs after actionlint, even when actionlint is missing
     # or fails.
-    - name: workflows
+    - name: chex-workflows
       files:
         unset $(git rev-parse --local-env-vars); bun
         node_modules/@zgeoff/chex/src/read-branch-files.ts
@@ -116,28 +118,28 @@ pre-push:
     # each job lists package.json for {files}, inside a shell comment the
     # check never sees: every repo that takes the baseline has the file, as
     # it installs chex, and lefthook drops a listed path that does not exist.
-    - name: commits
+    - name: chex-commits
       files: echo package.json
       use_stdin: true
       run:
         '{clear-git-env} bun x --no-install diet -- bun x --no-install chex commits --pushed-refs #
         {files}'
     # package.json keeps this job from the same lefthook skip.
-    - name: local-paths
+    - name: chex-local-paths
       files: echo package.json
       use_stdin: true
       run:
         '{clear-git-env} bun x --no-install diet -- bun x --no-install chex local-paths
         --pushed-refs # {files}'
-    - name: test-timeouts
+    - name: chex-test-timeouts
       run: '{clear-git-env} bun x --no-install diet -- bun x --no-install chex test-timeouts'
-    - name: dependency-gates
+    - name: chex-dependency-gates
       run: '{clear-git-env} bun x --no-install diet -- bun x --no-install chex dependency-gates'
-    - name: typecheck
+    - name: chex-typecheck
       run: '{clear-git-env} bun x --no-install diet -- bun run typecheck'
     # A bunfig.toml reaches the job too, because a change to it skips the
     # related tests.
-    - name: test
+    - name: chex-test
       files:
         unset $(git rev-parse --local-env-vars); bun
         node_modules/@zgeoff/chex/src/read-branch-files.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/chex",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "description": "Run each shared docs and repo check as one subcommand, with the lefthook pre-push baseline that calls them",
   "keywords": [
     "checks",
@@ -41,7 +41,7 @@
   },
   "devDependencies": {
     "@types/bun": "1.4.4",
-    "@zgeoff/rig": "0.1.6",
+    "@zgeoff/rig": "0.2.0",
     "@zgeoff/std": "0.4.2",
     "@zgeoff/testing": "0.2.1",
     "tiny-invariant": "1.3.3",

package/src/dependency-gates/collect-stale-age-gate-excludes.ts

@@ -9,6 +9,8 @@ export function collectStaleAgeGateExcludes(
 ): DependencyGateFinding[] {
   const removalDates = collectRemovalDates(bunfig);
 
+  // Renovate bumps a first-party package as soon as it publishes, so its exclude stays for good and
+  // carries no removal date.
   return parseAgeGate(bunfig)
     .excludes.filter((name) => !firstPartyScopes.some((scope) => name.startsWith(scope)))
     .flatMap((name) => {

package/src/parse-lane-limits.ts

@@ -1,5 +1,5 @@
-// The limits match the max-test-timeout rule in @zgeoff/oxlint-config, which CI cannot import: the
-// workflow downloads this file and the modules it imports one by one.
+// The limits match the max-test-timeout rule in @zgeoff/oxlint-config, which neither chex nor the
+// copy that repo-sync puts in each repo can import.
 const standardLaneLimits: readonly (readonly [string, number])[] = [
   ['browser', 10_000],
   ['e2e', 15_000],

package/src/parse-rig-lane-limits.ts

@@ -0,0 +1,31 @@
+import { findMember } from './find-member.ts';
+
+export type ParsedRigLaneLimits =
+  | { readonly kind: 'parsed'; readonly limits: ReadonlyMap<string, number> }
+  | { readonly kind: 'refused'; readonly reason: string };
+
+// chex has no dependency on rig, and the copy that repo-sync puts in each repo imports no package,
+// so this reads the rig config's default export field by field. That export holds every standard
+// lane too, each with its limit in ms.
+export function parseRigLaneLimits(rigConfig: unknown): ParsedRigLaneLimits {
+  const lanes = findMember(rigConfig, 'lanes');
+
+  if (!Array.isArray(lanes)) {
+    return { kind: 'refused', reason: 'its default export has no list of lanes' };
+  }
+
+  const limits = new Map<string, number>();
+
+  for (const [index, lane] of lanes.entries()) {
+    const name = findMember(lane, 'name');
+    const limitMs = findMember(lane, 'limitMs');
+
+    if (typeof name !== 'string' || typeof limitMs !== 'number') {
+      return { kind: 'refused', reason: `lane ${index} lacks a name or a limitMs` };
+    }
+
+    limits.set(name, limitMs);
+  }
+
+  return { kind: 'parsed', limits };
+}

package/src/run-test-timeouts-check.ts

@@ -1,5 +1,7 @@
-import { basename, dirname, posix } from 'node:path';
+import { basename, dirname, join, posix } from 'node:path';
+import { findMember } from './find-member.ts';
 import { parseLaneLimits } from './parse-lane-limits.ts';
+import { parseRigLaneLimits } from './parse-rig-lane-limits.ts';
 import type { ShellWord } from './parse-shell-words.ts';
 import { parseShellWords } from './parse-shell-words.ts';
 import type { RunProgram } from './run-program.ts';
@@ -9,6 +11,7 @@ export interface TestTimeoutsCheckOptions {
   readonly cwd: string;
   readonly env: Readonly<Record<string, string | undefined>>;
   readonly runProgram: RunProgram;
+  readonly importModule: (absolutePath: string) => Promise<unknown>;
 }
 
 export interface TestTimeoutFinding {
@@ -19,16 +22,12 @@ export interface TestTimeoutFinding {
 }
 
 // The check reads the files as HEAD holds them, so a push checks what it sends.
-export function runTestTimeoutsCheck(
+export async function runTestTimeoutsCheck(
   options: Readonly<TestTimeoutsCheckOptions>,
-): TestTimeoutFinding[] {
+): Promise<TestTimeoutFinding[]> {
   const paths = runGit(options, ['ls-tree', '-r', '-z', '--name-only', 'HEAD']).split('\0');
 
-  const configText = paths.includes(oxlintConfigPath)
-    ? runGit(options, ['show', `HEAD:${oxlintConfigPath}`])
-    : null;
-
-  const limits = parseLaneLimits(configText);
+  const limits = await readLaneLimits(options, paths);
 
   const appRoots = new Set(
     paths.filter((path) => basename(path) === 'package.json').map((path) => dirname(path)),
@@ -54,7 +53,6 @@ export function runTestTimeoutsCheck(
 }
 
 const configPattern = /^\.?oxlintrc(?:\.[\w-]+)?\.jsonc?$/u;
-const oxlintConfigPath = '.oxlintrc.json';
 
 const checkedFiles = new Set(['package.json', 'bunfig.toml']);
 
@@ -68,6 +66,51 @@ function runGit(options: Readonly<TestTimeoutsCheckOptions>, args: readonly stri
   return result.stdout;
 }
 
+const rigConfigPath = 'rig.config.ts';
+const oxlintConfigPath = '.oxlintrc.json';
+
+// oxlint-config refuses the lanes option of its timeout rule in a repo with a rig.config.ts, so
+// that file alone sets the lanes there.
+async function readLaneLimits(
+  options: Readonly<TestTimeoutsCheckOptions>,
+  paths: readonly string[],
+): Promise<ReadonlyMap<string, number>> {
+  if (!paths.includes(rigConfigPath)) {
+    const configText = paths.includes(oxlintConfigPath)
+      ? runGit(options, ['show', `HEAD:${oxlintConfigPath}`])
+      : null;
+
+    return parseLaneLimits(configText);
+  }
+
+  // Only an import resolves the rig config's lanes, and an import reads the working tree, so the
+  // check runs only while the working tree holds HEAD's copy.
+  const diff = options.runProgram(['git', 'diff', '--quiet', 'HEAD', '--', rigConfigPath], {
+    cwd: options.cwd,
+    env: options.env,
+  });
+
+  if (diff.exitCode === 1) {
+    throw new Error(
+      `${rigConfigPath} in the working tree differs from HEAD; commit or stash the change, because the check reads the lane limits from HEAD`,
+    );
+  }
+
+  if (diff.exitCode !== 0) {
+    throw new Error(`git diff --quiet HEAD -- ${rigConfigPath} failed: ${diff.stderr.trim()}`);
+  }
+
+  const loaded = await options.importModule(join(options.cwd, rigConfigPath));
+
+  const parsed = parseRigLaneLimits(findMember(loaded, 'default'));
+
+  if (parsed.kind === 'refused') {
+    throw new Error(`cannot read the lanes of ${rigConfigPath}: ${parsed.reason}`);
+  }
+
+  return parsed.limits;
+}
+
 // A setting that turns a timeout rule off or down to a warning escapes the limits as a disable
 // comment does, so it needs the same ticket, in a comment on its line or the lines above it.
 function collectConfigFindings(path: string, text: string): TestTimeoutFinding[] {
@@ -288,12 +331,6 @@ function collectScriptFindings(
   });
 }
 
-function findMember(value: unknown, key: string): unknown {
-  return typeof value === 'object' && value !== null && Object.hasOwn(value, key)
-    ? Reflect.get(value, key)
-    : undefined;
-}
-
 interface LaneLimit {
   readonly lane: string;
   readonly limitMs: number;
@@ -475,9 +512,14 @@ const ticketPattern = /\b[A-Z][A-Z0-9]*-\d+\b/u;
 const floorPattern = /\bfloor:[\s*]*[^\s*]/u;
 
 // Returns the exit code: 0 when clean, 1 with a finding, and 2 when the check cannot run.
-export function runTestTimeoutsCommand(): number {
+export async function runTestTimeoutsCommand(): Promise<number> {
   try {
-    const findings = runTestTimeoutsCheck({ cwd: process.cwd(), env: process.env, runProgram });
+    const findings = await runTestTimeoutsCheck({
+      cwd: process.cwd(),
+      env: process.env,
+      runProgram,
+      importModule: (path) => import(path),
+    });
 
     for (const finding of findings) {
       process.stdout.write(`${finding.path}: ${finding.message}\n`);
@@ -494,5 +536,5 @@ export function runTestTimeoutsCommand(): number {
 }
 
 if (import.meta.main) {
-  process.exitCode = runTestTimeoutsCommand();
+  process.exitCode = await runTestTimeoutsCommand();
 }