pr-checkmate 1.21.1 → 1.21.3

package/README.md

@@ -22,6 +22,11 @@
 * ✅ Secret scanning via `gitleaks`.
 * ✅ **Delta mode** — in GitHub PR context only changed files are checked, not the entire project.
 * ✅ **Parallel execution** — all independent checks run concurrently, cutting CI time ~4×.
+* ✅ TypeScript type check — runs `tsc --noEmit`, catches type errors before merge. Skips if no `tsconfig.json` is found.
+* ✅ Diff code smells — scans PR diff for `console.*()` calls, `debugger` statements, and `TODO/FIXME/HACK/XXX` comments left in added lines.
+* ✅ PR description check — validates the PR body has at least 20 characters and includes a ticket reference (`Closes #123` or `PROJ-456` style).
+* ✅ Duplicate code detection — uses `jscpd` in delta mode (changed files in PR, or `src/` otherwise) with a 5-line / 50-token minimum threshold.
+* ✅ PR summary comment — after `npx pr-checkmate all`, posts a summary table to the CI log and upserts a comment on the PR. No spam on repeated pushes.
 
 <br>
 > ⚠️ **Note:** Currently, PR CheckMate only supports **Node.js projects**.
@@ -52,7 +57,7 @@ Users can override:
 
 User configuration is stored in:
 
-```
+```text
 <project-root>/pr-checkmate.json
 ```
 
@@ -115,7 +120,7 @@ npx pr-checkmate <job>
 
 | Job            | Description |
 |----------------|-------------|
-| `all`          | Run all checks in parallel (lint, deps, audit, security, circular, license, then spellcheck, pr-size, pr-title, outdated, markdown, then prettier) |
+| `all`          | Run all checks in parallel (lint, deps, audit, security, circular, license, then spellcheck, pr-size, pr-title, outdated, markdown, typecheck, diff-smell, pr-body, duplicate, then prettier). Posts a PR summary comment when run in a GitHub Actions PR context. |
 | `lint`         | Lint code using ESLint |
 | `prettier`     | Format code using Prettier |
 | `deps`         | Check unused / missing dependencies via depcheck |
@@ -128,12 +133,16 @@ npx pr-checkmate <job>
 | `pr-title`     | Validate PR title against Conventional Commits format |
 | `outdated`     | Report packages that are major versions behind |
 | `markdown`     | Lint `.md`/`.mdx` files via markdownlint (warning-only, delta mode) |
+| `typecheck`    | Run `tsc --noEmit` to catch type errors (blocking). Skips automatically if no `tsconfig.json` is found. |
+| `diff-smell`   | Scan PR diff for `console.*()`, `debugger`, and `TODO/FIXME/HACK/XXX` in added lines (warning-only, delta mode) |
+| `pr-body`      | Check PR description for minimum length (20 chars) and a ticket reference (warning-only) |
+| `duplicate`    | Detect duplicate code with `jscpd` — min 5 lines / 50 tokens (warning-only, delta mode in PR context) |
 
 <br>
 
 ### ⚡ Delta Mode
 
-In a GitHub Actions PR context, `lint`, `prettier`, `spellcheck`, and `markdown` automatically switch to **delta mode** — only the files changed in the PR are checked instead of the entire project. This is transparent and requires no configuration.
+In a GitHub Actions PR context, `lint`, `prettier`, `spellcheck`, `markdown`, `diff-smell`, and `duplicate` automatically switch to **delta mode** — only the files changed in the PR are checked instead of the entire project. This is transparent and requires no configuration.
 
 Outside of a PR context (local runs, push workflows) the checks fall back to the full project scan.
 
@@ -324,6 +333,30 @@ For the auto-commit feature to work, ensure your repository has the correct perm
 
 <br>
 
+### PR summary comment
+
+After `npx pr-checkmate all` finishes, it prints a summary table to the CI log and posts a comment on the PR. On repeated pushes the comment is updated in place — no duplicate comments accumulate.
+
+The comment looks like this:
+
+```text
+## PR CheckMate Summary
+
+**11 passed** · **3 warnings** · **0 failed** · **0 skipped**
+
+| Check | Result |
+|---|---|
+| ESLint | pass |
+| TypeScript | pass |
+| Diff Smells | warn — 2x console.*(), 1x TODO comment |
+| PR Body | warn — no ticket reference |
+...
+```
+
+This requires `GITHUB_TOKEN` with `pull-requests: write` permission. The auto-generated workflow already includes both — no extra setup is needed.
+
+<br>
+
 ## 🌍 Multilingual Spellcheck Support
 
 PR CheckMate includes built-in dictionaries for:

package/dist/config/constants.js

@@ -84,6 +84,10 @@ exports.DEFAULT_COMMANDS = {
     'npx pr-checkmate npm-audit': 'Run package vulnerabilities check',
     'npx pr-checkmate security': 'Security scan',
     'npx pr-checkmate spellcheck': 'Run spellcheck via cspell',
+    'npx pr-checkmate typecheck': 'TypeScript type check (tsc --noEmit)',
+    'npx pr-checkmate diff-smell': 'Scan git diff for code smells',
+    'npx pr-checkmate pr-body': 'Validate PR description',
+    'npx pr-checkmate duplicate': 'Detect duplicate code blocks (jscpd)',
 };
 exports.documentation = {
     eslint: 'https://eslint.org/docs/latest/rules/',

package/dist/config/loader.js

@@ -54,6 +54,10 @@ function mergeWithDefaults(userConfig) {
             ],
         },
         security: userConfig.security || defaults.security,
+        typecheck: { ...defaults.typecheck, ...userConfig.typecheck },
+        diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
+        prBody: { ...defaults.prBody, ...userConfig.prBody },
+        duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
     };
 }
 /**
@@ -110,6 +114,10 @@ function getDefaultConfig() {
             gitleaks: { enabled: true },
             'npm-audit': { enabled: true, auditLevel: 'moderate' },
         },
+        typecheck: { enabled: true },
+        diffSmell: { enabled: true },
+        prBody: { enabled: true, minLength: 20, requireTicket: true },
+        duplicate: { enabled: true, minLines: 5, minTokens: 50 },
     };
 }
 /**

package/dist/config/pr-checkmate-workflow.yml

@@ -263,3 +263,91 @@ jobs:
       - name: Run Markdown Lint
         run: npx pr-checkmate markdown
         continue-on-error: true
+
+  typecheck:
+    name: TypeScript Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run TypeScript Type Check
+        run: npx pr-checkmate typecheck
+        continue-on-error: true
+
+  diff-smell:
+    name: Diff Code Smell
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Scan Diff for Code Smells
+        run: npx pr-checkmate diff-smell
+        continue-on-error: true
+
+  pr-body:
+    name: PR Description
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check PR Description
+        run: npx pr-checkmate pr-body
+        continue-on-error: true
+
+  duplicate-check:
+    name: Duplicate Code
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check for Duplicate Code
+        run: npx pr-checkmate duplicate
+        continue-on-error: true

package/dist/init.js

@@ -37,6 +37,26 @@ const DEFAULT_CONFIG = {
         rules: {},
         ignores: [],
     },
+    // TypeScript type check
+    typecheck: {
+        enabled: true,
+    },
+    // Diff code smell detection
+    diffSmell: {
+        enabled: true,
+    },
+    // PR description validation
+    prBody: {
+        enabled: true,
+        minLength: 20,
+        requireTicket: true,
+    },
+    // Duplicate code detection (jscpd)
+    duplicate: {
+        enabled: true,
+        minLines: 5,
+        minTokens: 50,
+    },
     documentation: config_1.documentation,
 };
 async function init() {
@@ -117,6 +137,10 @@ async function init() {
                 eslint: { ...DEFAULT_CONFIG.eslint, ...(json.eslint || {}) },
                 prettier: { ...DEFAULT_CONFIG.prettier, ...(json.prettier || {}) },
                 cspell: { ...DEFAULT_CONFIG.cspell, ...(json.cspell || {}) },
+                typecheck: { ...DEFAULT_CONFIG.typecheck, ...(json.typecheck || {}) },
+                diffSmell: { ...DEFAULT_CONFIG.diffSmell, ...(json.diffSmell || {}) },
+                prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
+                duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
             };
             fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(updated, null, 2));
             utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');

package/dist/scripts/diff-smell.js

@@ -0,0 +1,97 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDiffSmell = runDiffSmell;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
+const loader_1 = require("../config/loader");
+const node_fs_1 = __importDefault(require("node:fs"));
+const SMELL_PATTERNS = [
+    // console.* calls added in diff (not in comments)
+    { pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/, label: 'console.*()' },
+    { pattern: /^\+(?!\+).*\bdebugger\b/, label: 'debugger statement' },
+    { pattern: /^\+\s*\/\/\s*TODO\b/i, label: 'TODO comment' },
+    { pattern: /^\+\s*\/\/\s*FIXME\b/i, label: 'FIXME comment' },
+    { pattern: /^\+\s*\/\/\s*HACK\b/i, label: 'HACK comment' },
+    { pattern: /^\+\s*\/\/\s*XXX\b/i, label: 'XXX marker' },
+];
+function readBaseSha() {
+    const eventName = process.env.GITHUB_EVENT_NAME;
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (eventName !== 'pull_request' || !eventPath || !node_fs_1.default.existsSync(eventPath)) {
+        return null;
+    }
+    try {
+        const event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
+        return event?.pull_request?.base?.sha ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function runDiffSmell() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.diffSmell?.enabled === false) {
+        utils_1.logger.info('[runDiffSmell]: Disabled in pr-checkmate.json, skipping');
+        result_collector_1.resultCollector.register('Diff Smells', 'skip');
+        return;
+    }
+    utils_1.logger.info('[runDiffSmell]: Scanning diff for code smells...');
+    const baseSha = readBaseSha();
+    if (!baseSha) {
+        utils_1.logger.info('[runDiffSmell]: Not in GitHub PR context, skipping');
+        result_collector_1.resultCollector.register('Diff Smells', 'skip');
+        return;
+    }
+    try {
+        const { stdout } = await (0, execa_1.execa)('git', [
+            'diff',
+            '--unified=0',
+            '--diff-filter=ACMR',
+            baseSha,
+            'HEAD',
+            '--',
+            '*.ts',
+            '*.tsx',
+            '*.js',
+            '*.jsx',
+        ]);
+        const lines = stdout.split('\n');
+        const findings = {};
+        for (const line of lines) {
+            for (const { pattern, label } of SMELL_PATTERNS) {
+                if (pattern.test(line)) {
+                    if (!findings[label])
+                        findings[label] = [];
+                    // Strip leading + and trim for display
+                    findings[label].push(line.slice(1).trim().substring(0, 100));
+                }
+            }
+        }
+        const totalFindings = Object.values(findings).reduce((sum, arr) => sum + arr.length, 0);
+        if (totalFindings === 0) {
+            utils_1.logger.info('[runDiffSmell]: ✅ No code smells detected in diff');
+            result_collector_1.resultCollector.register('Diff Smells', 'pass');
+            return;
+        }
+        utils_1.logger.warn(`[runDiffSmell]: ⚠️ Found ${totalFindings} code smell(s) in diff:`);
+        for (const [label, occurrences] of Object.entries(findings)) {
+            utils_1.logger.warn(`  ${label}: ${occurrences.length} occurrence(s)`);
+            occurrences.slice(0, 3).forEach(line => utils_1.logger.warn(`    ${line}`));
+            if (occurrences.length > 3) {
+                utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
+            }
+        }
+        const summary = Object.entries(findings)
+            .map(([label, arr]) => `${arr.length}× ${label}`)
+            .join(', ');
+        result_collector_1.resultCollector.register('Diff Smells', 'warn', summary);
+    }
+    catch (err) {
+        utils_1.logger.warn(`[runDiffSmell]: ⚠️ Could not analyze diff\n${err}`);
+        result_collector_1.resultCollector.register('Diff Smells', 'skip');
+    }
+}

package/dist/scripts/duplicate-check.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDuplicateCheck = runDuplicateCheck;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
+const loader_1 = require("../config/loader");
+const delta_1 = require("../utils/delta");
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
+async function runDuplicateCheck() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.duplicate?.enabled === false) {
+        utils_1.logger.info('[runDuplicateCheck]: Disabled in pr-checkmate.json, skipping');
+        result_collector_1.resultCollector.register('Duplicate Code', 'skip');
+        return;
+    }
+    const minLines = cfg.duplicate?.minLines ?? 5;
+    const minTokens = cfg.duplicate?.minTokens ?? 50;
+    utils_1.logger.info('[runDuplicateCheck]: Checking for duplicate code...');
+    const projectRoot = process.cwd();
+    const changedFiles = await (0, delta_1.getChangedFiles)(['.ts', '.tsx', '.js', '.jsx']);
+    // In PR context but no relevant files changed
+    if (changedFiles !== null && changedFiles.length === 0) {
+        utils_1.logger.info('[runDuplicateCheck]: No relevant files changed, skipping');
+        result_collector_1.resultCollector.register('Duplicate Code', 'skip');
+        return;
+    }
+    // Fall back to src/ or project root when not in delta mode
+    const srcPath = node_path_1.default.join(projectRoot, 'src');
+    const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [projectRoot]);
+    try {
+        const result = await (0, execa_1.execa)('npx', [
+            'jscpd',
+            '--min-lines',
+            String(minLines),
+            '--min-tokens',
+            String(minTokens),
+            '--reporters',
+            'console',
+            '--ignore',
+            'node_modules/**,dist/**,.git/**',
+            '--quiet',
+            ...targetPaths,
+        ], { reject: false });
+        const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+        const clonesMatch = output.match(/(\d+)\s+clone/i);
+        const cloneCount = clonesMatch ? parseInt(clonesMatch[1], 10) : 0;
+        if (cloneCount > 0) {
+            utils_1.logger.warn(`[runDuplicateCheck]: ⚠️ Found ${cloneCount} duplicate block(s)`);
+            if (output)
+                utils_1.logger.warn(output);
+            result_collector_1.resultCollector.register('Duplicate Code', 'warn', `${cloneCount} duplicate block(s)`);
+        }
+        else {
+            utils_1.logger.info('[runDuplicateCheck]: ✅ No significant code duplication found');
+            result_collector_1.resultCollector.register('Duplicate Code', 'pass');
+        }
+    }
+    catch (err) {
+        utils_1.logger.warn(`[runDuplicateCheck]: ⚠️ Could not run duplicate check\n${err}`);
+        result_collector_1.resultCollector.register('Duplicate Code', 'skip');
+    }
+}

package/dist/scripts/index.js

@@ -26,7 +26,13 @@ const pr_size_check_1 = require("./pr-size-check");
 const pr_title_lint_1 = require("./pr-title-lint");
 const outdated_deps_1 = require("./outdated-deps");
 const markdown_lint_1 = require("./markdown-lint");
+const typecheck_1 = require("./typecheck");
+const diff_smell_1 = require("./diff-smell");
+const pr_body_1 = require("./pr-body");
+const duplicate_check_1 = require("./duplicate-check");
+const pr_summary_1 = require("./pr-summary");
 const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
 const lint_1 = require("./lint");
 __exportStar(require("./dependency-check"), exports);
 __exportStar(require("./lint"), exports);
@@ -39,35 +45,69 @@ __exportStar(require("./pr-size-check"), exports);
 __exportStar(require("./pr-title-lint"), exports);
 __exportStar(require("./outdated-deps"), exports);
 __exportStar(require("./markdown-lint"), exports);
+__exportStar(require("./typecheck"), exports);
+__exportStar(require("./diff-smell"), exports);
+__exportStar(require("./pr-body"), exports);
+__exportStar(require("./duplicate-check"), exports);
+__exportStar(require("./pr-summary"), exports);
+/**
+ * Wraps a blocking check: registers 'pass' on success, 'fail' on throw (and re-throws).
+ */
+async function trackCheck(name, fn) {
+    try {
+        await fn();
+        result_collector_1.resultCollector.register(name, 'pass');
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message.split('\n')[0].substring(0, 120) : String(err);
+        result_collector_1.resultCollector.register(name, 'fail', msg);
+        throw err;
+    }
+}
+/**
+ * Wraps an informational check: registers 'pass' on success, 'warn' on throw (never re-throws).
+ */
+async function trackSoftCheck(name, fn) {
+    try {
+        await fn();
+        result_collector_1.resultCollector.register(name, 'pass');
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message.split('\n')[0].substring(0, 120) : String(err);
+        result_collector_1.resultCollector.register(name, 'warn', msg);
+    }
+}
 async function runJob(jobName) {
     utils_1.logger.info(`[runJob]: 🚀 Running job: ${jobName}`);
     try {
         switch (jobName) {
             case 'all':
-                // Phase 1: blocking checks in parallel
+                // Phase 1: blocking quality gates — run in parallel, fail fast on any throw
                 await Promise.all([
-                    (0, lint_1.runLint)(),
-                    (0, dependency_check_1.runDependencyCheck)(),
-                    (0, npm_audit_1.runNpmAudit)(),
-                    (0, security_1.runSecurityScan)(),
-                    (0, circular_deps_1.runCircularDeps)(),
-                    (0, license_check_1.runLicenseCheck)(),
+                    trackCheck('ESLint', lint_1.runLint),
+                    trackCheck('Dependencies', dependency_check_1.runDependencyCheck),
+                    trackCheck('NPM Audit', npm_audit_1.runNpmAudit),
+                    trackCheck('Security Scan', security_1.runSecurityScan),
+                    trackCheck('Circular Deps', circular_deps_1.runCircularDeps),
+                    trackCheck('License Check', license_check_1.runLicenseCheck),
+                    trackCheck('TypeScript', typecheck_1.runTypecheck),
                 ]);
-                // Phase 2: informational checks in parallel (never block)
+                // Phase 2: informational checks — old scripts tracked via wrapper,
+                // new scripts register themselves with accurate warn/skip status
                 await Promise.all([
-                    (0, pr_size_check_1.runPrSizeCheck)(),
-                    (0, pr_title_lint_1.runPrTitleLint)(),
-                    (0, outdated_deps_1.runOutdatedDeps)(),
-                    (0, markdown_lint_1.runMarkdownLint)(),
-                    (0, spellcheck_1.runSpellcheck)().catch(() => utils_1.logger.warn('⚠️ Spellcheck found issues, continuing...')),
+                    trackSoftCheck('PR Size', pr_size_check_1.runPrSizeCheck),
+                    trackSoftCheck('PR Title', pr_title_lint_1.runPrTitleLint),
+                    trackSoftCheck('Outdated Deps', outdated_deps_1.runOutdatedDeps),
+                    trackSoftCheck('Markdown', markdown_lint_1.runMarkdownLint),
+                    trackSoftCheck('Spellcheck', spellcheck_1.runSpellcheck),
+                    (0, diff_smell_1.runDiffSmell)(),
+                    (0, pr_body_1.runPrBodyCheck)(),
+                    (0, duplicate_check_1.runDuplicateCheck)(),
                 ]);
-                // Phase 3: prettier last — writes files
-                try {
-                    await (0, prettier_autoformat_1.runPrettier)();
-                }
-                catch {
-                    utils_1.logger.warn('⚠️ Prettier failed, continuing...');
-                }
+                // Phase 3: prettier last — may write files, then auto-commit in CI
+                await trackSoftCheck('Prettier', prettier_autoformat_1.runPrettier);
+                // Phase 4: print summary table + post GitHub PR comment
+                await (0, pr_summary_1.runPrSummary)();
                 break;
             case 'lint':
                 await (0, lint_1.runLint)();
@@ -106,8 +146,20 @@ async function runJob(jobName) {
             case 'markdown':
                 await (0, markdown_lint_1.runMarkdownLint)();
                 break;
+            case 'typecheck':
+                await (0, typecheck_1.runTypecheck)();
+                break;
+            case 'diff-smell':
+                await (0, diff_smell_1.runDiffSmell)();
+                break;
+            case 'pr-body':
+                await (0, pr_body_1.runPrBodyCheck)();
+                break;
+            case 'duplicate':
+                await (0, duplicate_check_1.runDuplicateCheck)();
+                break;
             default:
-                utils_1.logger.warn(`[runJob]: Unknown job "${jobName}". Available: all, lint, deps, npm-audit, prettier, spellcheck, security, circular, license, pr-size, pr-title, outdated, markdown`);
+                utils_1.logger.warn(`[runJob]: Unknown job "${jobName}". Available: all, lint, deps, npm-audit, prettier, spellcheck, security, circular, license, pr-size, pr-title, outdated, markdown, typecheck, diff-smell, pr-body, duplicate`);
         }
     }
     catch (err) {

package/dist/scripts/npm-audit.js

@@ -8,8 +8,27 @@ const utils_1 = require("../utils");
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const execa_1 = require("execa");
+const config_1 = require("../config");
+const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
+function isSeverityAtLeast(severity, level) {
+    const sevIdx = SEVERITY_ORDER.indexOf(severity);
+    const lvlIdx = SEVERITY_ORDER.indexOf(level);
+    return sevIdx >= 0 && lvlIdx >= 0 && sevIdx >= lvlIdx;
+}
+function getOwnPackageName() {
+    try {
+        const ownPkg = node_path_1.default.resolve(__dirname, '../../package.json');
+        const content = node_fs_1.default.readFileSync(ownPkg, 'utf-8');
+        return JSON.parse(content).name ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
- * Run npm audit on the current project
+ * Run npm audit on the current project.
+ * Only fails on vulnerabilities in direct dependencies — transitive ones are silently ignored.
+ * Vulnerabilities in pr-checkmate itself are also skipped — the client cannot fix those.
  */
 async function runNpmAudit() {
     utils_1.logger.info('Running npm audit...');
@@ -19,25 +38,28 @@ async function runNpmAudit() {
         utils_1.logger.warn('[runNpmAudit]: ⚠️ No package.json found in project root — skipping npm audit');
         return;
     }
+    const config = (0, config_1.loadProjectConfig)();
+    const auditLevel = config.security?.['npm-audit']?.auditLevel ?? 'moderate';
+    const ownName = getOwnPackageName();
+    let report;
     try {
-        const { stdout, stderr } = await (0, execa_1.execa)('npm', ['audit', '--audit-level=moderate'], {
+        const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], {
             cwd: projectRoot,
+            reject: false,
         });
-        if (stdout)
-            utils_1.logger.info(stdout);
-        if (stderr)
-            utils_1.logger.warn(stderr);
-        utils_1.logger.info('[runNpmAudit]: ✅ NPM audit finished successfully');
+        report = JSON.parse(stdout);
     }
     catch (error) {
-        const err = error;
-        utils_1.logger.error('[runNpmAudit]: ❌ NPM audit found issues');
-        if (err.stdout)
-            utils_1.logger.error(err.stdout);
-        if (err.stderr)
-            utils_1.logger.warn(err.stderr);
-        if (!err.stdout && !err.stderr)
-            utils_1.logger.error(err.message);
-        throw err;
+        utils_1.logger.error('[runNpmAudit]: ❌ Failed to parse npm audit output');
+        throw error;
+    }
+    const directVulns = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+    if (directVulns.length === 0) {
+        utils_1.logger.info('[runNpmAudit]: ✅ NPM audit finished successfully');
+        return;
+    }
+    for (const v of directVulns) {
+        utils_1.logger.error(`[runNpmAudit]: ❌ ${v.name} — severity: ${v.severity}`);
     }
+    throw new Error(`[runNpmAudit]: ${directVulns.length} direct dependency vulnerability(ies) found at level "${auditLevel}" or above`);
 }

package/dist/scripts/pr-body.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPrBodyCheck = runPrBodyCheck;
+const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
+const loader_1 = require("../config/loader");
+const node_fs_1 = __importDefault(require("node:fs"));
+// Matches "Closes #123", "Fixes #45", "Resolves #7" or JIRA-style "PROJ-456"
+const TICKET_PATTERN = /(?:closes?|fixes?|resolves?)\s+#\d+|[A-Z][A-Z0-9]+-\d+/i;
+async function runPrBodyCheck() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.prBody?.enabled === false) {
+        utils_1.logger.info('[runPrBodyCheck]: Disabled in pr-checkmate.json, skipping');
+        result_collector_1.resultCollector.register('PR Body', 'skip');
+        return;
+    }
+    const minLength = cfg.prBody?.minLength ?? 20;
+    const requireTicket = cfg.prBody?.requireTicket ?? true;
+    utils_1.logger.info('[runPrBodyCheck]: Checking PR description...');
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (!eventPath || !node_fs_1.default.existsSync(eventPath)) {
+        utils_1.logger.info('[runPrBodyCheck]: Not in GitHub CI, skipping');
+        result_collector_1.resultCollector.register('PR Body', 'skip');
+        return;
+    }
+    let event;
+    try {
+        event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
+    }
+    catch (err) {
+        utils_1.logger.warn(`[runPrBodyCheck]: ⚠️ Could not read GitHub event\n${err}`);
+        result_collector_1.resultCollector.register('PR Body', 'skip');
+        return;
+    }
+    const pr = event.pull_request;
+    if (!pr) {
+        utils_1.logger.info('[runPrBodyCheck]: No PR data found, skipping');
+        result_collector_1.resultCollector.register('PR Body', 'skip');
+        return;
+    }
+    const body = pr.body ?? '';
+    const trimmed = body.trim();
+    const issues = [];
+    if (trimmed.length < minLength) {
+        issues.push(`description too short (${trimmed.length}/${minLength} chars min)`);
+    }
+    if (requireTicket && trimmed && !TICKET_PATTERN.test(trimmed)) {
+        issues.push('no ticket reference (e.g. "Closes #123" or "PROJ-456")');
+    }
+    if (issues.length > 0) {
+        utils_1.logger.warn('[runPrBodyCheck]: ⚠️ PR description issues:');
+        issues.forEach(issue => utils_1.logger.warn(`  • ${issue}`));
+        result_collector_1.resultCollector.register('PR Body', 'warn', issues.join('; '));
+    }
+    else {
+        utils_1.logger.info('[runPrBodyCheck]: ✅ PR description looks good');
+        result_collector_1.resultCollector.register('PR Body', 'pass');
+    }
+}

package/dist/scripts/pr-summary.js

@@ -0,0 +1,119 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPrSummary = runPrSummary;
+const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
+const node_fs_1 = __importDefault(require("node:fs"));
+const STATUS_ICON = {
+    pass: '✅',
+    warn: '⚠️',
+    fail: '❌',
+    skip: '⏭️',
+};
+// Unique marker so we can find and update the comment on re-runs
+const COMMENT_MARKER = '<!-- pr-checkmate-summary -->';
+function getPrContext() {
+    const token = process.env.GITHUB_TOKEN;
+    const repository = process.env.GITHUB_REPOSITORY;
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (!token || !repository || !eventPath || !node_fs_1.default.existsSync(eventPath)) {
+        return null;
+    }
+    try {
+        const event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
+        const prNumber = event?.pull_request?.number;
+        if (!prNumber)
+            return null;
+        const [owner, repo] = repository.split('/');
+        return { token, owner, repo, prNumber };
+    }
+    catch {
+        return null;
+    }
+}
+function buildMarkdownReport(results) {
+    const { passed, warned, failed, skipped } = result_collector_1.resultCollector.getSummary();
+    const rows = results
+        .map(r => {
+        const icon = STATUS_ICON[r.status];
+        const details = r.details ? ` — ${r.details}` : '';
+        return `| ${r.name} | ${icon} ${r.status}${details} |`;
+    })
+        .join('\n');
+    return [
+        COMMENT_MARKER,
+        '## 🔍 PR CheckMate Summary',
+        '',
+        `**${passed} passed** · **${warned} warnings** · **${failed} failed** · **${skipped} skipped**`,
+        '',
+        '| Check | Result |',
+        '|---|---|',
+        rows,
+        '',
+        '_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate)_',
+    ].join('\n');
+}
+async function upsertGithubComment(body) {
+    const ctx = getPrContext();
+    if (!ctx) {
+        utils_1.logger.info('[runPrSummary]: Skipping GitHub comment (not in PR context or GITHUB_TOKEN missing)');
+        return;
+    }
+    const { token, owner, repo, prNumber } = ctx;
+    const apiBase = `https://api.github.com/repos/${owner}/${repo}`;
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        'User-Agent': 'pr-checkmate',
+        Accept: 'application/vnd.github.v3+json',
+        'Content-Type': 'application/json',
+    };
+    try {
+        // Look for an existing pr-checkmate comment to update (avoids spam on repeated pushes)
+        const listRes = await fetch(`${apiBase}/issues/${prNumber}/comments`, { headers });
+        if (listRes.ok) {
+            const comments = (await listRes.json());
+            const existing = comments.find(c => typeof c.body === 'string' && c.body.includes(COMMENT_MARKER));
+            if (existing) {
+                await fetch(`${apiBase}/issues/comments/${existing.id}`, {
+                    method: 'PATCH',
+                    headers,
+                    body: JSON.stringify({ body }),
+                });
+                utils_1.logger.info('[runPrSummary]: ✅ Updated PR CheckMate comment on PR');
+                return;
+            }
+        }
+        // No existing comment — post a new one
+        await fetch(`${apiBase}/issues/${prNumber}/comments`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body }),
+        });
+        utils_1.logger.info('[runPrSummary]: ✅ Posted PR CheckMate summary comment to PR');
+    }
+    catch (err) {
+        utils_1.logger.warn(`[runPrSummary]: ⚠️ Could not post GitHub comment: ${err}`);
+    }
+}
+async function runPrSummary() {
+    const results = result_collector_1.resultCollector.getResults();
+    if (results.length === 0)
+        return;
+    const { passed, warned, failed, skipped } = result_collector_1.resultCollector.getSummary();
+    utils_1.logger.info('');
+    utils_1.logger.info('═══════════════════════════════════════════════════════════════');
+    utils_1.logger.info('  PR CheckMate Summary');
+    utils_1.logger.info('═══════════════════════════════════════════════════════════════');
+    for (const r of results) {
+        const icon = STATUS_ICON[r.status];
+        const details = r.details ? `: ${r.details}` : '';
+        utils_1.logger.info(`  ${icon}  ${r.name}${details}`);
+    }
+    utils_1.logger.info('───────────────────────────────────────────────────────────────');
+    utils_1.logger.info(`  ✅ ${passed} passed  ⚠️ ${warned} warnings  ❌ ${failed} failed  ⏭️ ${skipped} skipped`);
+    utils_1.logger.info('═══════════════════════════════════════════════════════════════');
+    await upsertGithubComment(buildMarkdownReport(results));
+}

package/dist/scripts/typecheck.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runTypecheck = runTypecheck;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+const loader_1 = require("../config/loader");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+async function runTypecheck() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.typecheck?.enabled === false) {
+        utils_1.logger.info('[runTypecheck]: Disabled in pr-checkmate.json, skipping');
+        return;
+    }
+    utils_1.logger.info('[runTypecheck]: Running TypeScript type check...');
+    const tsConfigPath = node_path_1.default.join(process.cwd(), 'tsconfig.json');
+    if (!node_fs_1.default.existsSync(tsConfigPath)) {
+        utils_1.logger.info('[runTypecheck]: No tsconfig.json found, skipping');
+        return;
+    }
+    const result = await (0, execa_1.execa)('npx', ['tsc', '--noEmit'], { reject: false });
+    if (result.exitCode !== 0) {
+        const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+        const errorCount = (output.match(/error TS\d+/g) ?? []).length;
+        utils_1.logger.warn(`[runTypecheck]: ⚠️ TypeScript found ${errorCount} type error(s):`);
+        if (output)
+            utils_1.logger.warn(output);
+        throw new Error(`TypeScript: ${errorCount} type error(s)`);
+    }
+    utils_1.logger.info('[runTypecheck]: ✅ TypeScript type check passed');
+}

package/dist/utils/index.js

@@ -22,6 +22,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const logger_1 = require("./logger");
 __exportStar(require("./logger"), exports);
 __exportStar(require("./delta"), exports);
+__exportStar(require("./result-collector"), exports);
 function cleanupTempFile(filePath) {
     try {
         if (node_fs_1.default.existsSync(filePath)) {

package/dist/utils/result-collector.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resultCollector = void 0;
+class ResultCollector {
+    constructor() {
+        this.results = [];
+    }
+    register(name, status, details) {
+        const idx = this.results.findIndex(r => r.name === name);
+        const entry = { name, status, ...(details && { details }) };
+        if (idx >= 0) {
+            this.results[idx] = entry;
+        }
+        else {
+            this.results.push(entry);
+        }
+    }
+    getResults() {
+        return [...this.results];
+    }
+    clear() {
+        this.results = [];
+    }
+    getSummary() {
+        return {
+            passed: this.results.filter(r => r.status === 'pass').length,
+            warned: this.results.filter(r => r.status === 'warn').length,
+            failed: this.results.filter(r => r.status === 'fail').length,
+            skipped: this.results.filter(r => r.status === 'skip').length,
+        };
+    }
+}
+exports.resultCollector = new ResultCollector();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.21.1",
+    "version": "1.21.3",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -74,8 +74,9 @@
         "eslint-plugin-prettier": "^5.5.4",
         "execa": "^9.6.0",
         "gitleaks-secret-scanner-fixed": "^2.1.3",
-        "markdownlint-cli": "^0.45.0",
         "inquirer": "^13.0.1",
+        "jscpd": "^3.5.10",
+        "markdownlint-cli": "^0.49.0",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",
         "typescript": "^5.9.3"

package/src/config/pr-checkmate-workflow.yml

@@ -263,3 +263,91 @@ jobs:
       - name: Run Markdown Lint
         run: npx pr-checkmate markdown
         continue-on-error: true
+
+  typecheck:
+    name: TypeScript Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run TypeScript Type Check
+        run: npx pr-checkmate typecheck
+        continue-on-error: true
+
+  diff-smell:
+    name: Diff Code Smell
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Scan Diff for Code Smells
+        run: npx pr-checkmate diff-smell
+        continue-on-error: true
+
+  pr-body:
+    name: PR Description
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check PR Description
+        run: npx pr-checkmate pr-body
+        continue-on-error: true
+
+  duplicate-check:
+    name: Duplicate Code
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check for Duplicate Code
+        run: npx pr-checkmate duplicate
+        continue-on-error: true