pr-checkmate 1.21.12 → 1.21.14

package/LICENSE

@@ -1,9 +1,54 @@
-Copyright © 2025 Mybono.
-All rights reserved.
+PROPRIETARY SOFTWARE LICENSE
+All Rights Reserved
 
-This software and associated documentation files (the “Software”) are the exclusive property of the copyright holder.
+Copyright (c) 2025-2026 Mybono. All Rights Reserved.
 
-Permission is hereby NOT granted to any person or entity to copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, or use the Software in any manner, unless an explicit written permission is provided by the copyright holder.
+================================================================================
+NOTICE
+================================================================================
 
-Any unauthorized use, modification, reproduction, or distribution of the Software is strictly prohibited and may result in civil and criminal penalties.
+This software and its source code, documentation, data, models, and all
+associated materials (collectively, the "Software") are the confidential and
+proprietary property of Mybono (the "Owner").
 
+NO LICENSE IS GRANTED. This is NOT open-source software. The Software is
+made available for viewing solely to persons explicitly and individually
+authorized in writing by the Owner. The mere presence of this source code in
+any repository, archive, or medium does NOT constitute permission to use it.
+
+================================================================================
+RESTRICTIONS
+================================================================================
+
+Without the prior express written permission of the Owner, you MAY NOT:
+
+  1. Copy, reproduce, or duplicate the Software, in whole or in part.
+  2. Use or execute the Software for any purpose, commercial or otherwise.
+  3. Modify, adapt, translate, or create derivative works from the Software.
+  4. Distribute, publish, sublicense, sell, rent, lease, or transfer the
+     Software or any portion thereof to any third party.
+  5. Fork, mirror, or re-host the Software in any public or private repository.
+  6. Reverse engineer, decompile, or disassemble the Software.
+  7. Remove, obscure, or alter this notice or any copyright, trademark, or
+     other proprietary notices contained in the Software.
+
+Any use not expressly permitted in writing by the Owner is strictly
+prohibited and constitutes a violation of applicable copyright and
+intellectual property laws.
+
+================================================================================
+NO WARRANTY
+================================================================================
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+OWNER BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+================================================================================
+CONTACT
+================================================================================
+
+For licensing inquiries or permission requests, contact the Owner: Mybono.

package/dist/core/checks/dependency-check.js

@@ -16,22 +16,26 @@ exports.dependencyCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
-        let stdout;
+        // Resolve the bundled depcheck binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when depcheck isn't on the path.
+        let depcheckBin;
         try {
-            ({ stdout } = await (0, execa_1.execa)('npx', ['depcheck', '--json'], { cwd: ctx.cwd }));
+            depcheckBin = (0, utils_1.resolvePackageBin)('depcheck', 'bin/depcheck.js');
         }
-        catch (err) {
-            // depcheck exits non-zero when it finds issues but still emits JSON on stdout.
-            if (err instanceof execa_1.ExecaError && err.stdout) {
-                stdout = err.stdout;
-            }
-            else {
-                throw err;
-            }
+        catch {
+            return (0, types_1.skip)('depcheck unavailable');
         }
+        // reject:false — depcheck exits non-zero when it finds issues but still emits JSON on stdout.
+        const { stdout } = await (0, execa_1.execa)(process.execPath, [depcheckBin, '--json'], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
         const start = stdout.indexOf('{');
         const end = stdout.lastIndexOf('}');
-        const json = start !== -1 && end !== -1 ? stdout.slice(start, end + 1) : stdout;
+        // No JSON at all → the tool couldn't produce a result; skip rather than fail the client's PR.
+        if (start === -1 || end === -1)
+            return (0, types_1.skip)('depcheck produced no output');
+        const json = stdout.slice(start, end + 1);
         let result;
         try {
             result = JSON.parse(json);

package/dist/core/checks/license-check.js

@@ -24,10 +24,24 @@ exports.licenseCheck = {
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);
         const allowLicenses = ctx.config.licenseCheck?.allowLicenses ?? [];
-        const { stdout } = await (0, execa_1.execa)('npx', ['license-checker', '--json', '--production'], {
-            cwd: ctx.cwd,
-        });
-        const licenses = JSON.parse(stdout);
+        // Resolve the bundled license-checker binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
+        let licenseCheckerBin;
+        try {
+            licenseCheckerBin = (0, utils_1.resolvePackageBin)('license-checker', 'bin/license-checker');
+        }
+        catch {
+            return (0, types_1.skip)('license-checker unavailable');
+        }
+        const { stdout, failed } = await (0, execa_1.execa)(process.execPath, [licenseCheckerBin, '--json', '--production'], { cwd: ctx.cwd, reject: false });
+        let licenses;
+        try {
+            licenses = JSON.parse(stdout);
+        }
+        catch {
+            // Tool couldn't produce parseable output; skip rather than fail the client's PR.
+            return (0, types_1.skip)(failed ? 'license-checker failed to run' : 'license-checker produced invalid JSON');
+        }
         const violations = [];
         for (const [pkg, info] of Object.entries(licenses)) {
             if (allowPackages.has(bareName(pkg)))

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.21.12",
+    "version": "1.21.14",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -72,6 +72,7 @@
         "@typescript-eslint/parser": "^8.47.0",
         "@wasm-fmt/clang-format": "^22.1.8",
         "cspell": "^9.3.2",
+        "depcheck": "^1.4.7",
         "eslint": "^9.26.0",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-import": "^2.29.0",
@@ -80,6 +81,7 @@
         "gitleaks-secret-scanner-fixed": "^2.1.3",
         "inquirer": "^13.0.1",
         "jscpd": "^3.5.10",
+        "license-checker": "^25.0.1",
         "markdownlint-cli": "^0.49.0",
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",