pr-checkmate 1.21.11 → 1.21.14

package/LICENSE

@@ -1,9 +1,54 @@
-Copyright © 2025 Mybono.
-All rights reserved.
+PROPRIETARY SOFTWARE LICENSE
+All Rights Reserved
 
-This software and associated documentation files (the “Software”) are the exclusive property of the copyright holder.
+Copyright (c) 2025-2026 Mybono. All Rights Reserved.
 
-Permission is hereby NOT granted to any person or entity to copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, or use the Software in any manner, unless an explicit written permission is provided by the copyright holder.
+================================================================================
+NOTICE
+================================================================================
 
-Any unauthorized use, modification, reproduction, or distribution of the Software is strictly prohibited and may result in civil and criminal penalties.
+This software and its source code, documentation, data, models, and all
+associated materials (collectively, the "Software") are the confidential and
+proprietary property of Mybono (the "Owner").
 
+NO LICENSE IS GRANTED. This is NOT open-source software. The Software is
+made available for viewing solely to persons explicitly and individually
+authorized in writing by the Owner. The mere presence of this source code in
+any repository, archive, or medium does NOT constitute permission to use it.
+
+================================================================================
+RESTRICTIONS
+================================================================================
+
+Without the prior express written permission of the Owner, you MAY NOT:
+
+  1. Copy, reproduce, or duplicate the Software, in whole or in part.
+  2. Use or execute the Software for any purpose, commercial or otherwise.
+  3. Modify, adapt, translate, or create derivative works from the Software.
+  4. Distribute, publish, sublicense, sell, rent, lease, or transfer the
+     Software or any portion thereof to any third party.
+  5. Fork, mirror, or re-host the Software in any public or private repository.
+  6. Reverse engineer, decompile, or disassemble the Software.
+  7. Remove, obscure, or alter this notice or any copyright, trademark, or
+     other proprietary notices contained in the Software.
+
+Any use not expressly permitted in writing by the Owner is strictly
+prohibited and constitutes a violation of applicable copyright and
+intellectual property laws.
+
+================================================================================
+NO WARRANTY
+================================================================================
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+OWNER BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+CONTACT
+================================================================================
+
+For licensing inquiries or permission requests, contact the Owner: Mybono.

package/dist/cli.js

@@ -27,6 +27,8 @@ const COMMAND_TO_CHECK = {
     duplicate: 'Duplicate Code',
     commitlint: 'Commitlint',
     'cpp-format': 'C++ Format',
+    'python-lint': 'Ruff Lint',
+    'python-format': 'Ruff Format',
 };
 const cmd = process.argv[2];
 void (async () => {

package/dist/config/loader.js

@@ -61,6 +61,11 @@ function mergeWithDefaults(userConfig) {
             ...userConfig.cpp,
             clangFormat: { ...defaults.cpp?.clangFormat, ...userConfig.cpp?.clangFormat },
         },
+        python: {
+            ...defaults.python,
+            ...userConfig.python,
+            ruff: { ...defaults.python?.ruff, ...userConfig.python?.ruff },
+        },
         diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
         prBody: { ...defaults.prBody, ...userConfig.prBody },
         duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
@@ -133,6 +138,7 @@ function getDefaultConfig() {
         },
         typecheck: { enabled: true },
         cpp: { enabled: true, clangFormat: { style: 'LLVM' } },
+        python: { enabled: true, ruff: { lint: true, format: true } },
         diffSmell: { enabled: true },
         prBody: { enabled: true, minLength: 20, requireTicket: true },
         duplicate: { enabled: true, minLines: 5, minTokens: 50 },

package/dist/core/checks/dependency-check.js

@@ -16,22 +16,26 @@ exports.dependencyCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
-        let stdout;
+        // Resolve the bundled depcheck binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when depcheck isn't on the path.
+        let depcheckBin;
         try {
-            ({ stdout } = await (0, execa_1.execa)('npx', ['depcheck', '--json'], { cwd: ctx.cwd }));
+            depcheckBin = (0, utils_1.resolvePackageBin)('depcheck', 'bin/depcheck.js');
         }
-        catch (err) {
-            // depcheck exits non-zero when it finds issues but still emits JSON on stdout.
-            if (err instanceof execa_1.ExecaError && err.stdout) {
-                stdout = err.stdout;
-            }
-            else {
-                throw err;
-            }
+        catch {
+            return (0, types_1.skip)('depcheck unavailable');
         }
+        // reject:false — depcheck exits non-zero when it finds issues but still emits JSON on stdout.
+        const { stdout } = await (0, execa_1.execa)(process.execPath, [depcheckBin, '--json'], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
         const start = stdout.indexOf('{');
         const end = stdout.lastIndexOf('}');
-        const json = start !== -1 && end !== -1 ? stdout.slice(start, end + 1) : stdout;
+        // No JSON at all → the tool couldn't produce a result; skip rather than fail the client's PR.
+        if (start === -1 || end === -1)
+            return (0, types_1.skip)('depcheck produced no output');
+        const json = stdout.slice(start, end + 1);
         let result;
         try {
             result = JSON.parse(json);

package/dist/core/checks/license-check.js

@@ -24,10 +24,24 @@ exports.licenseCheck = {
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);
         const allowLicenses = ctx.config.licenseCheck?.allowLicenses ?? [];
-        const { stdout } = await (0, execa_1.execa)('npx', ['license-checker', '--json', '--production'], {
-            cwd: ctx.cwd,
-        });
-        const licenses = JSON.parse(stdout);
+        // Resolve the bundled license-checker binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
+        let licenseCheckerBin;
+        try {
+            licenseCheckerBin = (0, utils_1.resolvePackageBin)('license-checker', 'bin/license-checker');
+        }
+        catch {
+            return (0, types_1.skip)('license-checker unavailable');
+        }
+        const { stdout, failed } = await (0, execa_1.execa)(process.execPath, [licenseCheckerBin, '--json', '--production'], { cwd: ctx.cwd, reject: false });
+        let licenses;
+        try {
+            licenses = JSON.parse(stdout);
+        }
+        catch {
+            // Tool couldn't produce parseable output; skip rather than fail the client's PR.
+            return (0, types_1.skip)(failed ? 'license-checker failed to run' : 'license-checker produced invalid JSON');
+        }
         const violations = [];
         for (const [pkg, info] of Object.entries(licenses)) {
             if (allowPackages.has(bareName(pkg)))

package/dist/core/checks/python-format.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pythonFormatCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../utils");
+const targets_1 = require("../targets");
+const types_1 = require("../types");
+const PY_GLOBS = ['*.py'];
+/**
+ * Formats changed Python files with Ruff's formatter (WASM, no Python/pip needed).
+ * Read-only in check mode (`warn` when files differ from formatted output); rewrites
+ * files in place when `write` so CI can auto-commit — mirrors the Prettier/C++ checks.
+ */
+exports.pythonFormatCheck = {
+    name: 'Ruff Format',
+    phase: 'format',
+    applies(ctx) {
+        return (ctx.config.python?.enabled !== false &&
+            ctx.config.python?.ruff?.format !== false &&
+            ctx.languages.includes('python'));
+    },
+    async run(ctx) {
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, PY_GLOBS);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_1.pass)('no Python files changed');
+        const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+        const workspace = new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+        let unformatted = 0;
+        for (const rel of targets) {
+            const abs = node_path_1.default.join(ctx.cwd, rel);
+            let content;
+            try {
+                content = node_fs_1.default.readFileSync(abs, 'utf-8');
+            }
+            catch {
+                continue; // renamed/removed between diff and read — skip
+            }
+            let formatted;
+            try {
+                formatted = workspace.format(content);
+            }
+            catch (err) {
+                // A syntax error makes Ruff throw — that's a lint concern, not a format failure.
+                utils_1.logger.warn(`[Ruff Format]: ⚠️ Could not format ${rel} (syntax error?)\n${err}`);
+                continue;
+            }
+            if (formatted === content)
+                continue;
+            unformatted += 1;
+            if (ctx.write)
+                node_fs_1.default.writeFileSync(abs, formatted);
+        }
+        if (unformatted === 0)
+            return (0, types_1.pass)();
+        if (!ctx.write) {
+            utils_1.logger.warn(`[Ruff Format]: ⚠️ ${unformatted} Python file(s) need formatting`);
+            return (0, types_1.warn)(`${unformatted} file(s) need formatting (run with write to fix)`);
+        }
+        utils_1.logger.info(`[Ruff Format]: ✅ Reformatted ${unformatted} Python file(s)`);
+        return (0, types_1.pass)(`reformatted ${unformatted} file(s)`);
+    },
+};

package/dist/core/checks/python-lint.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pythonLintCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../utils");
+const targets_1 = require("../targets");
+const types_1 = require("../types");
+const PY_GLOBS = ['*.py'];
+/**
+ * Lints changed Python files with Ruff, bundled as a self-contained WASM module
+ * (`@astral-sh/ruff-wasm-nodejs`) so it runs on a bare Node image with no Python
+ * or pip install. Informational by design — reports issues without failing the
+ * build, matching how formatting checks roll out; promote to blocking per repo
+ * once teams have adopted it. Uses Ruff's default rule set (pyflakes + pycodestyle).
+ */
+exports.pythonLintCheck = {
+    name: 'Ruff Lint',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.python?.enabled !== false &&
+            ctx.config.python?.ruff?.lint !== false &&
+            ctx.languages.includes('python'));
+    },
+    async run(ctx) {
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, PY_GLOBS);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_1.pass)('no Python files changed');
+        const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+        const workspace = new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+        let totalIssues = 0;
+        let filesWithIssues = 0;
+        for (const rel of targets) {
+            let content;
+            try {
+                content = node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, rel), 'utf-8');
+            }
+            catch {
+                continue; // renamed/removed between diff and read — skip
+            }
+            const diagnostics = workspace.check(content);
+            if (diagnostics.length === 0)
+                continue;
+            filesWithIssues += 1;
+            totalIssues += diagnostics.length;
+            utils_1.logger.warn(`[Ruff Lint]: ⚠️ ${rel}: ${diagnostics.length} issue(s)`);
+            diagnostics
+                .slice(0, 5)
+                .forEach((d) => utils_1.logger.warn(`    ${rel}:${d.start_location.row} ${d.code ?? '?'} ${d.message}`));
+            if (diagnostics.length > 5)
+                utils_1.logger.warn(`    ... and ${diagnostics.length - 5} more`);
+        }
+        if (totalIssues === 0)
+            return (0, types_1.pass)();
+        return (0, types_1.warn)(`${totalIssues} issue(s) in ${filesWithIssues} file(s)`);
+    },
+};

package/dist/core/registry.js

@@ -21,9 +21,11 @@ const pr_title_lint_1 = require("./checks/pr-title-lint");
 const outdated_deps_1 = require("./checks/outdated-deps");
 const markdown_lint_1 = require("./checks/markdown-lint");
 const spellcheck_1 = require("./checks/spellcheck");
+const python_lint_1 = require("./checks/python-lint");
 // format — runs last, may write files
 const prettier_1 = require("./checks/prettier");
 const cpp_format_1 = require("./checks/cpp-format");
+const python_format_1 = require("./checks/python-format");
 /**
  * Every check, in declaration order. The orchestrator groups them by `phase`
  * (blocking → informational → format) and runs each phase's checks in parallel.
@@ -49,7 +51,9 @@ exports.REGISTRY = [
     outdated_deps_1.outdatedDepsCheck,
     markdown_lint_1.markdownLintCheck,
     spellcheck_1.spellcheckCheck,
+    python_lint_1.pythonLintCheck,
     // format
     prettier_1.prettierCheck,
     cpp_format_1.cppFormatCheck,
+    python_format_1.pythonFormatCheck,
 ];

package/dist/core/targets.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTargetFiles = resolveTargetFiles;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+/**
+ * Lists the files a language check should operate on, matched by pathspec `globs`
+ * (e.g. `['*.py']`). Uses the PR diff range when available (delta mode), else
+ * scans all tracked files. Returns an empty array when nothing matches, and
+ * `null` when git itself is unusable (caller should `skip`).
+ *
+ * Only ACMR files are returned (Added/Copied/Modified/Renamed) — deletions are
+ * excluded, so every returned path exists on disk and is safe to read.
+ */
+async function resolveTargetFiles(ctx, globs) {
+    try {
+        const args = ctx.baseSha
+            ? [
+                'diff',
+                '--name-only',
+                '--diff-filter=ACMR',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+                '--',
+                ...globs,
+            ]
+            : ['ls-files', ...globs];
+        const { stdout } = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd, reject: false });
+        const files = stdout
+            .split('\n')
+            .map(f => f.trim())
+            .filter(Boolean);
+        utils_1.logger.info(`[targets]: ${ctx.baseSha ? '📂 Delta' : 'Full scan'}: ${files.length} file(s) for ${globs.join(', ')}`);
+        return files;
+    }
+    catch (err) {
+        utils_1.logger.warn(`[targets]: ⚠️ Could not list files\n${err}`);
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.21.11",
+    "version": "1.21.14",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -59,6 +59,7 @@
     "author": "Artur Polishchuk",
     "license": "LicenseRef-Proprietary",
     "dependencies": {
+        "@astral-sh/ruff-wasm-nodejs": "^0.15.20",
         "@commitlint/cli": "^21.2.0",
         "@commitlint/config-conventional": "^21.2.0",
         "@cspell/dict-es-es": "^3.0.8",
@@ -71,6 +72,7 @@
         "@typescript-eslint/parser": "^8.47.0",
         "@wasm-fmt/clang-format": "^22.1.8",
         "cspell": "^9.3.2",
+        "depcheck": "^1.4.7",
         "eslint": "^9.26.0",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-import": "^2.29.0",
@@ -79,6 +81,7 @@
         "gitleaks-secret-scanner-fixed": "^2.1.3",
         "inquirer": "^13.0.1",
         "jscpd": "^3.5.10",
+        "license-checker": "^25.0.1",
         "markdownlint-cli": "^0.49.0",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",