cuke-dedup 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to CukeDedup are documented in this file. The project follows
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2026-09-07
+
+Initial public release.
+
+### Added
+
+- Static duplicate, near-duplicate, ambiguous, reusable, and unused Cucumber step analysis.
+- JavaScript, JSX, TypeScript, and TSX source adapters and Gherkin Markdown support.
+- Terminal, JSON, JSON Lines, HTML, and SARIF reporters.
+- Duplication thresholds, semantic baselines, changed-file analysis, suppressions, and ignore files.
+- Native Cargo and npm distributions for eight supported targets.
+- A checksum-verified GitHub Action and an agent-oriented CukeDedup skill.
+
+[0.1.0]: https://github.com/figueiredoluiz/cuke-dedup/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Luiz Figueiredo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,386 @@
+# CukeDedup
+
+[![CI](https://github.com/figueiredoluiz/cuke-dedup/actions/workflows/ci.yml/badge.svg)](https://github.com/figueiredoluiz/cuke-dedup/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+CukeDedup finds duplicate, near-duplicate, ambiguous, reusable, and unused Cucumber/Gherkin step definitions. It analyzes source code statically: project configuration and test code are never executed.
+
+Current support includes:
+
+- JavaScript/JSX and TypeScript/TSX step definitions, including common module variants.
+- Cucumber.js, Playwright BDD, and Cypress Cucumber workflows.
+- Classic `.feature` files and Gherkin Markdown `.feature.md` files.
+- Terminal, JSON, JSON Lines, HTML, and SARIF reports.
+- Threshold, baseline, changed-file, suppression, and ignore-file workflows.
+
+## Install
+
+Install the native CLI through Cargo:
+
+```sh
+cargo install cuke-dedup
+```
+
+Or install the native launcher in a JavaScript project:
+
+```sh
+npm install --save-dev cuke-dedup
+npx cuke-dedup .
+```
+
+To build from source, clone the repository with Rust 1.90 or newer and run
+`cargo build --release --locked`.
+
+## Usage
+
+The path-only and explicit `check` forms are equivalent when both include a path:
+
+```sh
+cuke-dedup .
+cuke-dedup check .
+cuke-dedup . --threshold 5
+cuke-dedup . --print-config
+cuke-dedup . --reporters terminal,json,html,sarif
+cuke-dedup . --reporters jsonl
+cuke-dedup . --output reports/cuke-dedup
+```
+
+`check` is reserved as the explicit subcommand and requires a path. To analyze a directory literally named `check`, use `cuke-dedup ./check`.
+
+With no configuration, CukeDedup respects `.gitignore` and `.cuke-dedupignore`, excludes common generated directories, discovers classic `.feature` files and Gherkin Markdown `.feature.md` files, and inspects conventional JavaScript/TypeScript step registrations such as `Given`, `When`, `Then`, and `defineStep`, including common aliases.
+
+## Configuration
+
+### Precedence and config files
+
+Configuration precedence is:
+
+```text
+CLI flags > explicit --config > auto-discovered CukeDedup config > detected framework configuration > built-in defaults
+```
+
+CukeDedup accepts `--config/-c <file>`, auto-discovers one configuration source, and lets CLI values replace matching config values. Automatic discovery stops at the first valid source in this order:
+
+```text
+.cuke-dedup.json
+.config/cuke-dedup.json
+.config/.cuke-dedup.json
+cuke-dedup.config.json (legacy compatibility)
+package.json#cukeDedup
+```
+
+An explicit `--config` path bypasses automatic discovery and is a fatal configuration error when it cannot be read or parsed. Relative config, output, and baseline paths are resolved from the analyzed root. An invalid auto-discovered file emits a warning and falls through to the next source. JavaScript projects may use the `cukeDedup` key in `package.json`; other repositories should prefer `.cuke-dedup.json`.
+
+### Example configuration
+
+```json
+{
+  "definitions": ["features/steps/**/*.ts"],
+  "features": ["features/**/*.{feature,feature.md}"],
+  "exclude": ["dist/**"],
+  "excludeDefaults": true,
+  "includeHidden": false,
+  "threshold": 5,
+  "requireFeatures": true,
+  "noMetrics": false,
+  "reporters": ["terminal", "json", "html", "sarif"],
+  "output": "reports/cuke-dedup",
+  "rules": {
+    "duplicate-matcher": "error",
+    "duplicate-handler": "error",
+    "near-duplicate-step": "warning",
+    "unused-definition": "off"
+  },
+  "suppressions": [
+    {
+      "rule": "duplicate-handler",
+      "path": "features/steps/legacy.ts",
+      "matcher": "the legacy flow is complete",
+      "reason": "Kept distinct while the legacy flow is retired"
+    }
+  ]
+}
+```
+
+### Suppressions
+
+Every suppression must include a non-empty `reason` and select at least a `path` or `matcher`:
+
+- When both selectors are present, both must match.
+- For a pair finding, a configured `path` must contain every involved definition.
+- A matcher selector must select at least one involved definition.
+
+These rules prevent a directory-scoped exception from hiding a conflict that crosses into maintained code.
+
+One definition can instead carry an auditable source-local suppression. The directive must be immediately above the registration, select one rule, and include a reason:
+
+```ts
+// cuke-dedup:ignore duplicate-handler -- retained for an external compatibility contract
+Given("the legacy flow completes", legacyHandler);
+```
+
+Malformed directives are operational errors rather than silently ignored comments. A directive suppresses findings involving its attached definition only.
+
+### Framework discovery and corpus boundaries
+
+When `features` is not explicitly configured, CukeDedup statically reads literal paths from the project's BDD setup: Playwright-BDD's `defineBddConfig`, Cypress `e2e.specPattern` when the Badeball Cucumber preprocessor is installed, and Cucumber.js configuration. It never executes project configuration. Cucumber directories include both `.feature` and `.feature.md`; Playwright-BDD directories follow that framework's `.feature` default. Explicit file or glob paths are preserved, so a project can select names such as `*.spec`. Dynamic paths produce a warning and can be made deterministic by setting `features` in CukeDedup's own configuration.
+
+Analysis is intentionally scoped to the supplied root: every discovered definition and feature under that root belongs to one comparison corpus. In a monorepo whose packages use independent step registries, run CukeDedup once per package (for example, `cuke-dedup packages/accounts`) instead of treating the monorepo root as one suite. Framework detection selects the appropriate registration patterns but does not silently split the corpus because mixed-framework projects can deliberately share definitions.
+
+`.feature.md` selects the Gherkin Markdown parser. Other extensions selected by a custom or framework glob are treated as classic Gherkin. This prevents ordinary Markdown files from being scanned while still allowing conventions such as `.spec`.
+
+### Exclusions and ignore files
+
+Configured `exclude` patterns replace custom patterns from lower-precedence layers, while built-in generated-directory exclusions remain independently enabled. An exclusion may name one file, one directory, or a glob.
+
+- Set `excludeDefaults` to `false` to analyze an explicitly selected workspace under `node_modules`, `target`, or another protected directory.
+- Set `includeHidden` to `true` to descend into dot-directories.
+- Definitions, features, excludes, reporters, and suppressions replace the corresponding lower-precedence value.
+- Scalar values and individual rule severities merge by precedence and rule name.
+
+Configured `definitions`, `features`, `exclude`, and suppression-path values use `globset` syntax against root-relative paths normalized with `/`. `*` and `?` may cross `/`; use `**` when a recursive directory boundary should be obvious to readers. Character classes such as `[ab]`, brace alternatives such as `{js,ts}`, and backslash escaping are supported. These configuration globs are distinct from `.gitignore` and `.cuke-dedupignore`, which use directory-scoped gitignore semantics and support negation.
+
+Repositories may also place a `.cuke-dedupignore` file at the analyzed root or in any descendant directory. It uses gitignore syntax: blank lines and `#` comments are ignored, `/` anchors a rule to the ignore file's directory, a trailing `/` selects directories, and `!` negates an earlier matching rule. Nested files apply only to their directory subtree. These rules are applied in addition to `.gitignore`, built-in exclusions, and configured `exclude` patterns. `--no-default-excludes` disables only the built-in generated-directory list; it does not disable either ignore file. Configured `exclude` patterns remain hard exclusions and cannot be negated from `.cuke-dedupignore`.
+
+Example `.cuke-dedupignore`:
+
+```gitignore
+# Generated feature sources
+features/generated/*
+**/*.generated.ts
+
+# Keep one reviewed generated definition
+!features/generated/reviewed.generated.ts
+```
+
+### CLI overrides and discovery diagnostics
+
+Equivalent discovery and rule overrides are available from the CLI:
+
+```sh
+cuke-dedup . \
+  --config .cuke-dedup.json \
+  --definitions 'features/steps/**/*.ts' \
+  --features 'features/**/*.feature' \
+  --exclude 'generated/legacy.ts' \
+  --exclude 'vendor' \
+  --exclude 'dist/**/*.ts' \
+  --threshold 5 \
+  --rule duplicate-matcher=warning
+```
+
+`--exclude` may be repeated or receive comma-separated patterns. Patterns are resolved relative to the analyzed root. The CLI equivalents for the discovery escape hatches are `--no-default-excludes` and `--include-hidden`. Explicit definition globs do not implicitly weaken either safety default.
+
+Use `--explain-discovery` to print the effective pattern origin, selected parser, matching pattern, and definition inputs without changing report output. Unmatched feature patterns are warnings. If definitions exist but no feature files match, CukeDedup warns and disables `unused-definition` findings rather than presenting an incomplete corpus as proof that every definition is unused. Set `requireFeatures: true` or pass `--require-features` to make that condition an operational failure (exit code `2`).
+
+Malformed discovered JavaScript or TypeScript remains a fail-closed operational error because partial extraction could make a duplication gate pass incorrectly. Fix the syntax, use a `.tsx` extension for JSX-bearing TypeScript, or narrow `definitions` to the actual step-definition sources.
+
+Use `--print-config` to serialize the fully merged and validated configuration as JSON and exit without discovery. The output includes the selected CukeDedup configuration source, framework-derived feature-pattern origin, CLI overrides, effective default exclusions, rule severities, and configuration warnings.
+
+## Rules
+
+| Rule | Default | Meaning |
+| --- | --- | --- |
+| `duplicate-matcher` | Error | Definitions use the same effective matcher. |
+| `normalized-matcher` | Error | Matchers become equivalent after normalization. |
+| `ambiguous-step` | Error | A concrete feature step matches multiple definitions. |
+| `duplicate-handler` | Error | Different matchers have the same alpha-normalized handler. |
+| `near-duplicate-step` | Warning | Matcher wording is close and handler structure agrees. |
+| `parameterization-candidate` | Warning | Handler structures differ primarily in literal values. |
+| `unused-definition` | Warning | No discovered feature step uses the definition. |
+
+Set a rule to `off`, `warning`, or `error` in configuration. The CLI also accepts `warn` as an alias for `warning`.
+
+Exact handler equivalence is always reported as `duplicate-handler` when matchers are not equivalent. If the matcher wording is also close, the same retained pair may carry the advisory `near-duplicate-step` finding as additional evidence.
+
+## Duplication threshold
+
+`threshold` controls the percentage of discovered definitions that may participate in active, error-level duplication findings. It accepts a value from `0` through `100` and defaults to `0`.
+
+```sh
+cuke-dedup . --threshold 5
+```
+
+The numerator contains unique definition locations involved in `duplicate-matcher`, `normalized-matcher`, `duplicate-handler`, and any `near-duplicate-step` or `parameterization-candidate` rule configured as an error. A definition is counted once even when it participates in several pairs. Suppressed and baselined findings do not count. The denominator is every discovered definition, including definitions without findings.
+
+The threshold passes when the unrounded percentage is less than or equal to the configured value. Active `ambiguous-step` and `unused-definition` errors remain independently fatal because they are correctness and usage policies rather than duplication tolerance. Empty projects have a `0%` duplication rate.
+
+## Reports
+
+Choose reporters according to how the result will be consumed:
+
+| Reporter | Destination | Best for |
+| --- | --- | --- |
+| `terminal` | stdout | Interactive local use and concise CI logs. |
+| `json` | File | Structured integration data. |
+| `jsonl` | stdout | Streaming shell and agent workflows. |
+| `html` | File | Human review with search, filters, and theme switching. |
+| `sarif` | File | Code-scanning platforms such as GitHub. |
+
+The `jsonl` reporter emits one compact object per finding followed by a final summary object. Because `terminal` and `jsonl` both own stdout, they cannot be selected together. JSONL can be combined with file reporters without contaminating the stream.
+
+JSON, HTML, and SARIF reports default to `reports/cuke-dedup/` and can be redirected with `--output`. Relative output paths are resolved from the analyzed root, not the shell's current directory. File-only reporter runs print the generated report paths to stdout.
+
+### JSON and HTML
+
+The JSON report uses schema version `1`. It includes relative source spans, severity, suppressions, similarity scores, suggested actions, structured matcher/handler evidence, threshold calculations, input counts, and execution metrics. The self-contained HTML report presents the same result with search, severity and rule filters, a light/dark theme switch, matcher differences, and side-by-side handler snippets.
+
+Set `noMetrics: true`, pass `--no-metrics`, or use the Action's `no-metrics: true` input to omit timing data when byte-reproducible artifacts matter.
+
+### JSON Lines
+
+JSONL schema version `1` is intended for streaming agent and shell consumption:
+
+```sh
+cuke-dedup . --reporters jsonl \
+  | jq -c 'select(.type == "finding" and .active)'
+```
+
+Each finding record is self-contained and carries a location-independent semantic fingerprint, active/suppressed state, threshold contribution, relative source spans, suggested action, and structured evidence. Free-text fields are capped at 2,000 Unicode characters; `truncatedFields` names every shortened field.
+
+The final `type: "summary"` record declares `recordCount` and `truncated: false`, and includes aggregate counts, threshold outcome, and execution metrics. Operational warnings and errors remain on stderr, so stdout can be parsed incrementally.
+
+### SARIF, safety, and scale
+
+SARIF 2.1.0 contains active findings, portable relative Unicode-aware locations, stable partial fingerprints, severity, similarity properties, suggested actions, and the threshold outcome for GitHub code scanning or another compatible consumer. Handler snippets are bounded before being embedded. HTML-visible text is escaped, bidirectional and invisible-format controls—including Unicode Tag characters—are removed, and embedded JSON characters that could close a script element are encoded.
+
+Terminal, JSON, HTML, and SARIF output retain at most 10,000 findings, prioritizing active errors before warnings and clearly reporting truncation. Their summaries still describe the complete analysis. JSONL remains the uncapped finding stream.
+
+## Agent Skill
+
+CukeDedup ships a portable Agent Skill that teaches coding assistants how to run the JSONL reporter, interpret its records, choose safe step-definition remediations, and verify the result without weakening the configured quality gate.
+
+Install it from a local checkout:
+
+```sh
+npx skills add ./skills --skill cuke-dedup
+```
+
+Install it directly from GitHub:
+
+```sh
+npx skills add figueiredoluiz/cuke-dedup --skill cuke-dedup
+```
+
+The installer can target supported coding agents or install globally; consult `npx skills add --help` for the available agent and scope flags. The skill is delivered from [`skills/cuke-dedup`](https://github.com/figueiredoluiz/cuke-dedup/blob/main/skills/cuke-dedup/SKILL.md), independently of the Cargo and npm packages. Invoke it explicitly as `$cuke-dedup` where supported, or ask the agent to analyze and safely fix duplicate Cucumber step definitions.
+
+## GitHub Action
+
+CukeDedup can run as a native, checksum- and provenance-verified GitHub Action without compiling Rust in the consumer repository:
+
+```yaml
+permissions:
+  contents: read
+
+steps:
+  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    with:
+      fetch-depth: 0
+      persist-credentials: false
+  - uses: figueiredoluiz/cuke-dedup@v0.1.0
+    id: cuke-dedup
+    with:
+      path: .
+      threshold: 5
+      config: .cuke-dedup.json
+      exclude: |
+        generated/**
+        fixtures/vendor/**
+      reporters: terminal,json,html,sarif
+      changed-since: ${{ github.event.pull_request.base.sha }}
+      no-metrics: true
+  - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+    if: always()
+    with:
+      name: cuke-dedup-reports
+      path: reports/cuke-dedup/
+```
+
+The Action adds JSON internally when needed so its outputs are always available: `exit-code`, `duplicate-rate`, `duplicate-definitions`, `total-definitions`, `json-report`, `html-report`, and `sarif-report`. Omitted threshold, reporter, and output inputs retain the resolved project configuration; explicitly supplied Action inputs override it. Set `reporters: jsonl` when an agent-oriented workflow should receive the stream in the step log; the Action also creates its internal JSON report for outputs. Its optional `baseline` and `fail-on-new` inputs expose the semantic new-finding gate to pull-request workflows. Inputs are passed directly to the native process as an argument array. The `version` input selects one exact compatible release. Downloads fail closed when the archive, adjacent SHA-256 checksum, provenance bundle, or exact archive contents are missing or invalid. Provenance verification uses the GitHub CLI available on GitHub-hosted runners; self-hosted runners must provide `gh` on `PATH`.
+
+For security-sensitive workflows, pin CukeDedup to the release tag's complete commit SHA. Exit codes retain the CLI contract; use `continue-on-error` only when a later workflow step intentionally evaluates the `exit-code` output.
+
+## Incremental CI adoption
+
+Only report findings involving files changed from a Git revision while still comparing those files against the complete definition corpus. Paths remain correct when analyzing a repository subdirectory, and untracked files are included:
+
+```sh
+cuke-dedup . --changed-since origin/main
+```
+
+Create or refresh a compact semantic baseline from the complete current analysis:
+
+```sh
+cuke-dedup . \
+  --baseline .cuke-dedup-baseline.json \
+  --update-baseline
+```
+
+Subsequent runs suppress the recorded multiplicity of each semantic finding. File renames and unrelated line shifts do not make a finding new, while adding another occurrence beyond the recorded count does:
+
+```sh
+cuke-dedup . --baseline .cuke-dedup-baseline.json --fail-on-new
+cuke-dedup . --baseline .cuke-dedup-baseline.json --fail-on-new 3
+```
+
+`--fail-on-new` defaults to zero when no count is supplied. `--update-baseline` and `--fail-on-new` require `--baseline`; they cannot be combined. Baseline updates also reject `--changed-since`, preventing a partial scan from erasing accepted findings outside the changed-file set. The sorted, versioned baseline records one semantic fingerprint per line with a multiplicity count for reviewable diffs.
+
+Changed-file mode still analyzes the complete discovered corpus so a changed definition can be compared with unchanged definitions. It filters the reported findings to those touching a changed file, while summary definition counts and the duplication-threshold denominator remain the complete corpus.
+
+An empty changed-file set emits a warning so an ignored target cannot look indistinguishable from a clean incremental run. Parse errors in unchanged files do not fail changed-file mode.
+
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | The duplication rate is within the threshold and no independent error rule failed. |
+| `1` | The duplication threshold was exceeded, an active non-duplication error rule failed, or the configured new-finding allowance was exceeded. |
+| `2` | Discovery, parsing, configuration, or another operational failure. |
+
+Warnings do not produce exit code `1`.
+
+## Compatibility and limitations
+
+- The minimum supported Rust version is 1.90. Node.js 20 and 24 are tested for the npm launcher.
+- Source adapters currently cover JavaScript and TypeScript, including JSX and common module variants. Unsupported languages are rejected rather than guessed.
+- CukeDedup uses static analysis and never executes framework configuration or test code. Dynamic configuration may require explicit `features` or `definitions` patterns.
+- Named handlers declared in the same source file are resolved to their bodies. Imported or unresolved handler references remain available for matcher and usage rules but are not compared by identifier text.
+- Malformed JavaScript or TypeScript fails closed. Unsupported regular-expression constructs emit a warning; malformed matcher escapes are operational errors.
+- One analysis root is one comparison corpus. Run independent monorepo packages separately when their step registries are unrelated.
+- Exact matcher and handler equivalence groups produce a linear spanning set of findings. Fuzzy structural comparisons are bounded at two million candidates and fail closed with exit code `2`; split independent suites or narrow the root if that limit is reached.
+- Before version 1.0, configuration and machine-report schemas may evolve between minor releases. Schema changes will be explicit and versioned.
+
+CukeDedup is an independent project. It is not affiliated with or endorsed by the Cucumber project or its maintainers.
+
+## Support
+
+Use the repository issue templates for reproducible bugs and focused feature requests. Include a minimal sanitized fixture and remove application-specific names, credentials, and source code. Report vulnerabilities privately according to [SECURITY.md](SECURITY.md).
+
+## Development
+
+The minimum supported Rust version is 1.90. The repository pins and tests that toolchain and also runs its quality checks on current stable Rust.
+
+Enable the tracked pre-commit hook once per clone and run the same compliance gate directly when needed:
+
+```sh
+git config core.hooksPath .githooks
+scripts/check/check.sh
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for prerequisites, focused commands, corpus and benchmark guidance, pull-request expectations, and the project decision process. Public Rust items carry rustdoc, and CI treats missing API documentation as an error.
+
+## Releases and verification
+
+Release notes and native archives are published on [GitHub Releases](https://github.com/figueiredoluiz/cuke-dedup/releases). Each archive has an adjacent SHA-256 checksum, a keyless Sigstore bundle, and GitHub build provenance. Verify provenance with:
+
+```sh
+gh attestation verify <archive> \
+  --repo figueiredoluiz/cuke-dedup \
+  --signer-workflow figueiredoluiz/cuke-dedup/.github/workflows/release.yml
+```
+
+Cargo, npm, the Git tag, and the GitHub release use the same version. See [CHANGELOG.md](CHANGELOG.md) for release history and [THIRD-PARTY-LICENSES.md](THIRD-PARTY-LICENSES.md) for the runtime dependency license inventory.
+
+## License
+
+[MIT](LICENSE)

package/SECURITY.md

@@ -0,0 +1,42 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are released for the latest published minor version. Before the first
+stable release, only the latest `0.x` release is supported.
+
+| Version | Supported |
+| --- | --- |
+| 0.1.x | Yes |
+| Older versions | No |
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a suspected vulnerability. Use
+[GitHub private vulnerability reporting](https://github.com/figueiredoluiz/cuke-dedup/security/advisories/new)
+to send a private report with the affected version, impact, reproduction steps, and
+any suggested mitigation. Remove credentials, proprietary source code, and unrelated
+personal data from the report.
+
+You should receive an acknowledgement within seven days. The maintainer will validate
+the report, coordinate a fix and disclosure with the reporter, and publish an advisory
+when users can take action. Please allow a reasonable remediation period before public
+disclosure.
+
+## Security boundaries
+
+CukeDedup treats analyzed repositories as untrusted input. It parses source and
+configuration files without executing project code. Terminal and machine-readable
+report content may contain attacker-controlled text from the analyzed repository and
+must not be treated as commands or agent instructions.
+
+The GitHub Action downloads native binaries only from this repository's versioned
+releases and verifies their published checksum and archive structure before execution.
+Consumers should pin the Action to a complete commit SHA.
+
+## Compromised releases
+
+Published Cargo and npm versions and GitHub release assets are immutable. If a release
+is compromised, the maintainer will publish a GitHub security advisory, deprecate the
+affected npm version, yank the affected Cargo version when appropriate, and issue a
+new patched version. Existing assets or version tags will not be silently replaced.

package/THIRD-PARTY-LICENSES.md

@@ -0,0 +1,98 @@
+# Third-party licenses
+
+CukeDedup's native binary contains the following non-development Rust dependencies.
+The declared SPDX expressions and upstream locations are generated from the locked
+Cargo dependency graph. Each dependency remains copyright its respective authors and
+is distributed under its declared license terms.
+
+The complete corresponding source and license files are available from the linked
+upstream projects and from each crate's source package on crates.io. This inventory is
+regenerated whenever `Cargo.lock` changes.
+
+| Package | Version | Declared license | Authors | Upstream |
+| --- | --- | --- | --- | --- |
+| aho-corasick | 1.1.5 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/aho-corasick |
+| anstream | 1.0.0 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
+| anstyle | 1.0.14 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
+| anstyle-parse | 1.0.0 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
+| anstyle-query | 1.1.5 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
+| anstyle-wincon | 3.0.11 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
+| anyhow | 1.0.104 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/anyhow |
+| bstr | 1.13.1 | MIT OR Apache-2.0 | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/bstr |
+| bytecount | 0.6.9 | Apache-2.0/MIT | Andre Bogus <bogusandre@gmail.de>, Joshua Landau <joshua@landau.ws> | https://github.com/llogiq/bytecount |
+| cc | 1.4.4 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/cc-rs |
+| clap | 4.6.6 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
+| clap_builder | 4.6.6 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
+| clap_derive | 4.6.4 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
+| clap_lex | 1.1.0 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
+| colorchoice | 1.0.5 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
+| convert_case | 0.10.0 | MIT | rutrum <dave@rutrum.net> | https://github.com/rutrum/convert-case |
+| crossbeam-deque | 0.8.7 | MIT OR Apache-2.0 | Not declared | https://github.com/crossbeam-rs/crossbeam |
+| crossbeam-epoch | 0.9.20 | MIT OR Apache-2.0 | Not declared | https://github.com/crossbeam-rs/crossbeam |
+| crossbeam-utils | 0.8.22 | MIT OR Apache-2.0 | Not declared | https://github.com/crossbeam-rs/crossbeam |
+| cucumber-expressions | 0.5.0 | MIT OR Apache-2.0 | Ilya Solovyiov <ilya.solovyiov@gmail.com>, Kai Ren <tyranron@gmail.com> | https://github.com/cucumber-rs/cucumber-expressions |
+| derive_more | 2.1.1 | MIT | Jelte Fennema <github-tech@jeltef.nl> | https://github.com/JelteF/derive_more |
+| derive_more-impl | 2.1.1 | MIT | Jelte Fennema <github-tech@jeltef.nl> | https://github.com/JelteF/derive_more |
+| either | 1.18.0 | MIT OR Apache-2.0 | Not declared | https://github.com/rayon-rs/either |
+| equivalent | 1.0.2 | Apache-2.0 OR MIT | Not declared | https://github.com/indexmap-rs/equivalent |
+| find-msvc-tools | 0.1.11 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/cc-rs |
+| gherkin | 0.16.0 | MIT OR Apache-2.0 | Brendan Molloy <brendan@bbqsrc.net> | https://github.com/cucumber-rs/gherkin |
+| globset | 0.4.20 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/ripgrep/tree/master/crates/globset |
+| hashbrown | 0.17.1 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/hashbrown |
+| heck | 0.5.0 | MIT OR Apache-2.0 | Not declared | https://github.com/withoutboats/heck |
+| ignore | 0.4.33 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/ripgrep/tree/master/crates/ignore |
+| indexmap | 2.14.1 | Apache-2.0 OR MIT | Not declared | https://github.com/indexmap-rs/indexmap |
+| is_terminal_polyfill | 1.70.2 | MIT OR Apache-2.0 | Not declared | https://github.com/polyfill-rs/is_terminal_polyfill |
+| itoa | 1.0.18 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/itoa |
+| libyaml-rs | 0.3.0 | MIT | David Tolnay <dtolnay@gmail.com>, YAML Organization <noreply@yaml.org> | https://github.com/yaml/libyaml-rs |
+| log | 0.4.34 | MIT OR Apache-2.0 | The Rust Project Developers | https://github.com/rust-lang/log |
+| memchr | 2.8.3 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com>, bluss | https://github.com/BurntSushi/memchr |
+| nom | 8.0.0 | MIT | contact@geoffroycouprie.com | https://github.com/rust-bakery/nom |
+| nom_locate | 5.0.0 | MIT | Florent FAYOLLE <florent.fayolle69@gmail.com>, Christopher Durham <cad97@cad97.com>, Valentin Lorentz <progval+git@progval.net> | https://github.com/fflorent/nom_locate |
+| once_cell_polyfill | 1.70.2 | MIT OR Apache-2.0 | Not declared | https://github.com/polyfill-rs/once_cell_polyfill |
+| peg | 0.6.3 | MIT | Kevin Mehall <km@kevinmehall.net> | https://github.com/kevinmehall/rust-peg |
+| peg-macros | 0.6.3 | MIT | Kevin Mehall <km@kevinmehall.net> | https://github.com/kevinmehall/rust-peg |
+| peg-runtime | 0.6.3 | MIT | Kevin Mehall <km@kevinmehall.net> | https://github.com/kevinmehall/rust-peg |
+| proc-macro2 | 1.0.107 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com>, Alex Crichton <alex@alexcrichton.com> | https://github.com/dtolnay/proc-macro2 |
+| quote | 1.0.47 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/quote |
+| regex | 1.13.1 | MIT OR Apache-2.0 | The Rust Project Developers, Andrew Gallant <jamslam@gmail.com> | https://github.com/rust-lang/regex |
+| regex-automata | 0.4.18 | MIT OR Apache-2.0 | The Rust Project Developers, Andrew Gallant <jamslam@gmail.com> | https://github.com/rust-lang/regex |
+| regex-syntax | 0.8.11 | MIT OR Apache-2.0 | The Rust Project Developers, Andrew Gallant <jamslam@gmail.com> | https://github.com/rust-lang/regex |
+| rustc_version | 0.4.1 | MIT OR Apache-2.0 | Not declared | https://github.com/djc/rustc-version-rs |
+| ryu | 1.0.23 | Apache-2.0 OR BSL-1.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/ryu |
+| same-file | 1.0.6 | Unlicense/MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/same-file |
+| semver | 1.0.28 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/semver |
+| serde | 1.0.229 | MIT OR Apache-2.0 | Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com> | https://github.com/serde-rs/serde |
+| serde_core | 1.0.229 | MIT OR Apache-2.0 | Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com> | https://github.com/serde-rs/serde |
+| serde_derive | 1.0.229 | MIT OR Apache-2.0 | Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com> | https://github.com/serde-rs/serde |
+| serde_json | 1.0.151 | MIT OR Apache-2.0 | Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com> | https://github.com/serde-rs/json |
+| shlex | 2.0.1 | MIT OR Apache-2.0 | comex <comexk@gmail.com>, Fenhl <fenhl@fenhl.net>, Adrian Taylor <adetaylor@chromium.org>, Alex Touchet <alextouchet@outlook.com>, Daniel Parks <dp+git@oxidized.org>, Garrett Berg <googberg@gmail.com> | https://github.com/comex/rust-shlex |
+| smawk | 0.3.3 | MIT | Martin Geisler <martin@geisler.net> | https://github.com/mgeisler/smawk |
+| streaming-iterator | 0.1.9 | MIT OR Apache-2.0 | Steven Fackler <sfackler@gmail.com> | https://github.com/sfackler/streaming-iterator |
+| strsim | 0.11.1 | MIT | Danny Guo <danny@dannyguo.com>, maxbachmann <oss@maxbachmann.de> | https://github.com/rapidfuzz/strsim-rs |
+| syn | 2.0.119 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/syn |
+| syn | 3.0.4 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/syn |
+| textwrap | 0.16.2 | MIT | Martin Geisler <martin@geisler.net> | https://github.com/mgeisler/textwrap |
+| thiserror | 2.0.20 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/thiserror |
+| thiserror-impl | 2.0.20 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/thiserror |
+| tinyvec | 1.12.0 | Zlib OR Apache-2.0 OR MIT | Lokathor <zefria@gmail.com> | https://github.com/Lokathor/tinyvec |
+| tinyvec_macros | 0.1.1 | MIT OR Apache-2.0 OR Zlib | Soveu <marx.tomasz@gmail.com> | https://github.com/Soveu/tinyvec_macros |
+| tree-sitter | 0.26.13 | MIT | Max Brunsfeld <maxbrunsfeld@gmail.com>, Amaan Qureshi <amaanq12@gmail.com> | https://github.com/tree-sitter/tree-sitter |
+| tree-sitter-javascript | 0.25.0 | MIT | Max Brunsfeld <maxbrunsfeld@gmail.com>, Amaan Qureshi <amaanq12@gmail.com> | https://github.com/tree-sitter/tree-sitter-javascript |
+| tree-sitter-language | 0.1.8 | MIT | Max Brunsfeld <maxbrunsfeld@gmail.com>, Amaan Qureshi <amaanq12@gmail.com> | https://github.com/tree-sitter/tree-sitter |
+| tree-sitter-typescript | 0.23.2 | MIT | Max Brunsfeld <maxbrunsfeld@gmail.com>, Amaan Qureshi <amaanq12@gmail.com> | https://github.com/tree-sitter/tree-sitter-typescript |
+| typed-builder | 0.23.2 | MIT OR Apache-2.0 | IdanArye <idanarye@gmail.com>, Chris Morgan <me@chrismorgan.info> | https://github.com/idanarye/rust-typed-builder |
+| typed-builder-macro | 0.23.2 | MIT OR Apache-2.0 | IdanArye <idanarye@gmail.com>, Chris Morgan <me@chrismorgan.info> | https://github.com/idanarye/rust-typed-builder |
+| unicode-ident | 1.0.24 | (MIT OR Apache-2.0) AND Unicode-3.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/unicode-ident |
+| unicode-linebreak | 0.1.5 | Apache-2.0 | Axel Forsman <axelsfor@gmail.com> | https://github.com/axelf4/unicode-linebreak |
+| unicode-normalization | 0.1.25 | MIT OR Apache-2.0 | kwantam <kwantam@gmail.com>, Manish Goregaokar <manishsmail@gmail.com> | https://github.com/unicode-rs/unicode-normalization |
+| unicode-segmentation | 1.13.3 | MIT OR Apache-2.0 | kwantam <kwantam@gmail.com>, Manish Goregaokar <manishsmail@gmail.com> | https://github.com/unicode-rs/unicode-segmentation |
+| unicode-width | 0.2.2 | MIT OR Apache-2.0 | kwantam <kwantam@gmail.com>, Manish Goregaokar <manishsmail@gmail.com> | https://github.com/unicode-rs/unicode-width |
+| unicode-xid | 0.2.6 | MIT OR Apache-2.0 | erick.tryzelaar <erick.tryzelaar@gmail.com>, kwantam <kwantam@gmail.com>, Manish Goregaokar <manishsmail@gmail.com> | https://github.com/unicode-rs/unicode-xid |
+| utf8parse | 0.2.2 | Apache-2.0 OR MIT | Joe Wilm <joe@jwilm.com>, Christian Duerr <contact@christianduerr.com> | https://github.com/alacritty/vte |
+| walkdir | 2.5.0 | Unlicense/MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/walkdir |
+| winapi-util | 0.1.11 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/winapi-util |
+| windows-link | 0.2.1 | MIT OR Apache-2.0 | Not declared | https://github.com/microsoft/windows-rs |
+| windows-sys | 0.61.2 | MIT OR Apache-2.0 | Not declared | https://github.com/microsoft/windows-rs |
+| yaml_serde | 0.10.7 | MIT OR Apache-2.0 | YAML Organization <noreply@yaml.org> | https://github.com/yaml/yaml-serde |
+| zmij | 1.0.23 | MIT | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/zmij |

package/npm/bin/cuke-dedup.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { run } from "../lib/launcher.mjs";
+
+process.exitCode = run(process.argv.slice(2));

package/npm/lib/launcher.mjs

@@ -0,0 +1,107 @@
+import { accessSync, constants, existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { constants as osConstants } from "node:os";
+
+const require = createRequire(import.meta.url);
+
+const targetManifest = JSON.parse(
+  readFileSync(new URL("../prebuilt-targets.json", import.meta.url), "utf8"),
+);
+
+export const TARGETS = Object.freeze(targetManifest.targets);
+
+export function detectLibc(report = process.report) {
+  try {
+    return report?.getReport()?.header?.glibcVersionRuntime ? "gnu" : "musl";
+  } catch {
+    return "musl";
+  }
+}
+
+export function targetFor(
+  platform = process.platform,
+  arch = process.arch,
+  libc = platform === "linux" ? detectLibc() : undefined,
+) {
+  const key = platform === "linux" ? `${platform}-${arch}-${libc}` : `${platform}-${arch}`;
+  const target = TARGETS[key];
+  if (!target) {
+    throw new Error(
+      `unsupported platform ${key}; supported platforms: ${Object.keys(TARGETS).join(", ")}`,
+    );
+  }
+  return target;
+}
+
+export function resolveBinary({
+  platform = process.platform,
+  arch = process.arch,
+  libc = platform === "linux" ? detectLibc() : undefined,
+  override = process.env.CUKE_DEDUP_BINARY,
+  resolvePackage = require.resolve,
+} = {}) {
+  if (override) {
+    const binary = resolve(override);
+    assertUsableBinary(binary, platform);
+    return binary;
+  }
+
+  const target = targetFor(platform, arch, libc);
+  let manifest;
+  try {
+    manifest = resolvePackage(`${target.packageName}/package.json`);
+  } catch (error) {
+    throw new Error(
+      `native package ${target.packageName} is missing; reinstall cuke-dedup with optional dependencies enabled`,
+      { cause: error },
+    );
+  }
+  const binary = resolve(dirname(manifest), "bin", target.binaryName);
+  assertUsableBinary(binary, platform);
+  return binary;
+}
+
+function assertUsableBinary(binary, platform) {
+  if (!existsSync(binary)) {
+    throw new Error(`cuke-dedup binary was not found at ${binary}`);
+  }
+  if (platform !== "win32") {
+    try {
+      accessSync(binary, constants.X_OK);
+    } catch (error) {
+      throw new Error(`cuke-dedup binary is not executable at ${binary}`, {
+        cause: error,
+      });
+    }
+  }
+}
+
+export function run(
+  args,
+  {
+    binary = undefined,
+    spawn = spawnSync,
+    stderr = process.stderr,
+  } = {},
+) {
+  let resolvedBinary;
+  try {
+    resolvedBinary = binary ?? resolveBinary();
+  } catch (error) {
+    stderr.write(`cuke-dedup: ${error.message}\n`);
+    return 2;
+  }
+
+  const result = spawn(resolvedBinary, args, { stdio: "inherit" });
+  if (result.error) {
+    stderr.write(`cuke-dedup: failed to start ${resolvedBinary}: ${result.error.message}\n`);
+    return 2;
+  }
+  if (result.signal) {
+    stderr.write(`cuke-dedup: native process terminated by ${result.signal}\n`);
+    return 128 + (osConstants.signals[result.signal] ?? 0);
+  }
+  return result.status ?? 2;
+}

package/npm/prebuilt-targets.json

@@ -0,0 +1,81 @@
+{
+  "schemaVersion": 1,
+  "targets": {
+    "darwin-arm64": {
+      "rustTarget": "aarch64-apple-darwin",
+      "packageName": "cuke-dedup-darwin-arm64",
+      "packageDirectory": "darwin-arm64",
+      "platform": "darwin",
+      "arch": "arm64",
+      "runner": "macos-15",
+      "binaryName": "cuke-dedup"
+    },
+    "darwin-x64": {
+      "rustTarget": "x86_64-apple-darwin",
+      "packageName": "cuke-dedup-darwin-x64",
+      "packageDirectory": "darwin-x64",
+      "platform": "darwin",
+      "arch": "x64",
+      "runner": "macos-15-intel",
+      "binaryName": "cuke-dedup"
+    },
+    "linux-arm64-gnu": {
+      "rustTarget": "aarch64-unknown-linux-gnu",
+      "packageName": "cuke-dedup-linux-arm64-gnu",
+      "packageDirectory": "linux-arm64-gnu",
+      "platform": "linux",
+      "arch": "arm64",
+      "libc": "gnu",
+      "runner": "ubuntu-22.04-arm",
+      "binaryName": "cuke-dedup"
+    },
+    "linux-arm64-musl": {
+      "rustTarget": "aarch64-unknown-linux-musl",
+      "packageName": "cuke-dedup-linux-arm64-musl",
+      "packageDirectory": "linux-arm64-musl",
+      "platform": "linux",
+      "arch": "arm64",
+      "libc": "musl",
+      "runner": "ubuntu-22.04-arm",
+      "binaryName": "cuke-dedup"
+    },
+    "linux-x64-gnu": {
+      "rustTarget": "x86_64-unknown-linux-gnu",
+      "packageName": "cuke-dedup-linux-x64-gnu",
+      "packageDirectory": "linux-x64-gnu",
+      "platform": "linux",
+      "arch": "x64",
+      "libc": "gnu",
+      "runner": "ubuntu-22.04",
+      "binaryName": "cuke-dedup"
+    },
+    "linux-x64-musl": {
+      "rustTarget": "x86_64-unknown-linux-musl",
+      "packageName": "cuke-dedup-linux-x64-musl",
+      "packageDirectory": "linux-x64-musl",
+      "platform": "linux",
+      "arch": "x64",
+      "libc": "musl",
+      "runner": "ubuntu-22.04",
+      "binaryName": "cuke-dedup"
+    },
+    "win32-arm64": {
+      "rustTarget": "aarch64-pc-windows-msvc",
+      "packageName": "cuke-dedup-win32-arm64",
+      "packageDirectory": "win32-arm64",
+      "platform": "win32",
+      "arch": "arm64",
+      "runner": "windows-11-arm",
+      "binaryName": "cuke-dedup.exe"
+    },
+    "win32-x64": {
+      "rustTarget": "x86_64-pc-windows-msvc",
+      "packageName": "cuke-dedup-win32-x64",
+      "packageDirectory": "win32-x64",
+      "platform": "win32",
+      "arch": "x64",
+      "runner": "windows-latest",
+      "binaryName": "cuke-dedup.exe"
+    }
+  }
+}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "cuke-dedup",
+  "version": "0.1.0",
+  "description": "Static analysis for duplicate and reusable Cucumber step definitions",
+  "type": "module",
+  "bin": {
+    "cuke-dedup": "npm/bin/cuke-dedup.js"
+  },
+  "files": [
+    "npm/bin/",
+    "npm/lib/",
+    "npm/prebuilt-targets.json",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "SECURITY.md",
+    "THIRD-PARTY-LICENSES.md"
+  ],
+  "scripts": {
+    "test": "node --test npm/test/*.test.mjs",
+    "skills:check": "node scripts/check/check-agent-skills.mjs",
+    "check:versions": "node scripts/check/check-release-version.mjs",
+    "pack:check": "npm pack --dry-run",
+    "corpus:check": "node scripts/check/check-corpus.mjs",
+    "benchmark": "node scripts/benchmark/benchmark-analysis.mjs"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/figueiredoluiz/cuke-dedup.git"
+  },
+  "homepage": "https://github.com/figueiredoluiz/cuke-dedup",
+  "bugs": "https://github.com/figueiredoluiz/cuke-dedup/issues",
+  "license": "MIT",
+  "keywords": [
+    "cucumber",
+    "gherkin",
+    "lint",
+    "testing",
+    "cli"
+  ],
+  "workspaces": [
+    "npm/platforms/*"
+  ],
+  "optionalDependencies": {
+    "cuke-dedup-darwin-arm64": "0.1.0",
+    "cuke-dedup-darwin-x64": "0.1.0",
+    "cuke-dedup-linux-arm64-gnu": "0.1.0",
+    "cuke-dedup-linux-arm64-musl": "0.1.0",
+    "cuke-dedup-linux-x64-gnu": "0.1.0",
+    "cuke-dedup-linux-x64-musl": "0.1.0",
+    "cuke-dedup-win32-arm64": "0.1.0",
+    "cuke-dedup-win32-x64": "0.1.0"
+  }
+}