pr-checkmate 1.21.5 → 1.21.7

package/README.md

@@ -26,6 +26,8 @@
 * ✅ Diff code smells — scans PR diff for `console.*()` calls, `debugger` statements, and `TODO/FIXME/HACK/XXX` comments left in added lines.
 * ✅ PR description check — validates the PR body has at least 20 characters and includes a ticket reference (`Closes #123` or `PROJ-456` style).
 * ✅ Duplicate code detection — uses `jscpd` in delta mode (changed files in PR, or `src/` otherwise) with a 5-line / 50-token minimum threshold.
+* ✅ Diff security scan — detects XSS vectors, `eval()`/`new Function()`, prototype pollution, weak crypto, CORS wildcards, insecure HTTP calls, command injection, and SQL injection patterns in added PR lines (warning-only, delta mode).
+* ✅ Sensitive file guard — warns when the PR touches `.env` files, private keys/certificates, CI/CD pipeline configs, auth middleware, infrastructure files, or lockfiles (warning-only, PR context only).
 * ✅ PR summary comment — after `npx pr-checkmate all`, posts a summary table to the CI log and upserts a comment on the PR. No spam on repeated pushes.
 
 <br>
@@ -120,7 +122,7 @@ npx pr-checkmate <job>
 
 | Job            | Description |
 |----------------|-------------|
-| `all`          | Run all checks in parallel (lint, deps, audit, security, circular, license, then spellcheck, pr-size, pr-title, outdated, markdown, typecheck, diff-smell, pr-body, duplicate, then prettier). Posts a PR summary comment when run in a GitHub Actions PR context. |
+| `all`          | Run all checks in parallel (lint, deps, audit, security, circular, license, then spellcheck, pr-size, pr-title, outdated, markdown, typecheck, diff-smell, pr-body, duplicate, diff-security, sensitive-files, then prettier). Posts a PR summary comment when run in a GitHub Actions PR context. |
 | `lint`         | Lint code using ESLint |
 | `prettier`     | Format code using Prettier |
 | `deps`         | Check unused / missing dependencies via depcheck |
@@ -137,12 +139,14 @@ npx pr-checkmate <job>
 | `diff-smell`   | Scan PR diff for `console.*()`, `debugger`, and `TODO/FIXME/HACK/XXX` in added lines (warning-only, delta mode) |
 | `pr-body`      | Check PR description for minimum length (20 chars) and a ticket reference (warning-only) |
 | `duplicate`    | Detect duplicate code with `jscpd` — min 5 lines / 50 tokens (warning-only, delta mode in PR context) |
+| `diff-security` | Scan PR diff for XSS vectors, `eval()`/`new Function()`, prototype pollution, weak crypto (MD5/SHA-1), CORS wildcards, insecure HTTP, command injection, and SQL injection in added lines (warning-only, delta mode, PR context only) |
+| `sensitive-files` | Detect PR changes to `.env` files, private keys/certificates, CI/CD configs, auth middleware, infrastructure files, and lockfiles (warning-only, PR context only) |
 
 <br>
 
 ### ⚡ Delta Mode
 
-In a GitHub Actions PR context, `lint`, `prettier`, `spellcheck`, `markdown`, `diff-smell`, and `duplicate` automatically switch to **delta mode** — only the files changed in the PR are checked instead of the entire project. This is transparent and requires no configuration.
+In a GitHub Actions PR context, `lint`, `prettier`, `spellcheck`, `markdown`, `diff-smell`, `duplicate`, and `diff-security` automatically switch to **delta mode** — only the files changed in the PR are checked instead of the entire project. This is transparent and requires no configuration.
 
 Outside of a PR context (local runs, push workflows) the checks fall back to the full project scan.
 

package/cspell.json

@@ -9,6 +9,8 @@
     "./node_modules/@cspell/dict-es-es/cspell-ext.json"
   ],
   "words": [
+    "ACMR",
+    "ACMRD",
     "accona",
     "Accona",
     "acepto",
@@ -41,6 +43,7 @@
     "Catrice",
     "Cerrar",
     "checkmate",
+    "circleci",
     "coincidan",
     "como",
     "comprobante",
@@ -85,6 +88,7 @@
     "gastos",
     "Gastos",
     "Gestión",
+    "gitlab",
     "gitleaks",
     "givatayim",
     "Givatayim",
@@ -113,9 +117,11 @@
     "israel",
     "jerusalem",
     "kfar",
+    "kubeconfig",
     "Kfar",
     "Kolomiets",
     "leído",
+    "lockfiles",
     "manera",
     "mavox",
     "Mavox",
@@ -182,6 +188,7 @@
     "sistema",
     "sultansadikov",
     "telaviv",
+    "travis",
     "Términos",
     "Teudat",
     "Tiempo",

package/dist/config/loader.js

@@ -58,6 +58,7 @@ function mergeWithDefaults(userConfig) {
         diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
         prBody: { ...defaults.prBody, ...userConfig.prBody },
         duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
+        commitlint: { ...defaults.commitlint, ...userConfig.commitlint },
     };
 }
 /**
@@ -118,6 +119,22 @@ function getDefaultConfig() {
         diffSmell: { enabled: true },
         prBody: { enabled: true, minLength: 20, requireTicket: true },
         duplicate: { enabled: true, minLines: 5, minTokens: 50 },
+        commitlint: {
+            enabled: true,
+            types: [
+                'feat',
+                'fix',
+                'docs',
+                'chore',
+                'ci',
+                'refactor',
+                'perf',
+                'style',
+                'revert',
+                'test',
+                'build',
+            ],
+        },
     };
 }
 /**

package/dist/scripts/commitlint.js

@@ -0,0 +1,110 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommitlint = runCommitlint;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+const loader_1 = require("../config/loader");
+const config_1 = require("../config");
+const result_collector_1 = require("../utils/result-collector");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const LOCAL_CONFIG_FILES = [
+    'commitlint.config.cjs',
+    'commitlint.config.js',
+    'commitlint.config.mjs',
+    'commitlint.config.ts',
+    '.commitlintrc',
+    '.commitlintrc.json',
+    '.commitlintrc.yaml',
+    '.commitlintrc.yml',
+    '.commitlintrc.js',
+    '.commitlintrc.cjs',
+];
+const DEFAULT_TYPES = [
+    'feat',
+    'fix',
+    'docs',
+    'chore',
+    'ci',
+    'refactor',
+    'perf',
+    'style',
+    'revert',
+    'test',
+    'build',
+];
+function buildTempConfig(types) {
+    const config = {
+        extends: [(0, utils_1.resolvePackageBin)('@commitlint/config-conventional', 'index.js')],
+        rules: {
+            'type-enum': [2, 'always', types],
+        },
+    };
+    const tmpFile = node_path_1.default.join(node_os_1.default.tmpdir(), `.commitlint-${process.pid}.json`);
+    node_fs_1.default.writeFileSync(tmpFile, JSON.stringify(config, null, 2));
+    return tmpFile;
+}
+async function getCommitRange() {
+    const eventName = process.env.GITHUB_EVENT_NAME;
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (eventName === 'pull_request' && eventPath && node_fs_1.default.existsSync(eventPath)) {
+        try {
+            const event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
+            const baseSha = event?.pull_request?.base?.sha;
+            const headSha = event?.pull_request?.head?.sha;
+            if (baseSha && headSha) {
+                return { from: baseSha, to: headSha };
+            }
+        }
+        catch (err) {
+            utils_1.logger.warn(`[runCommitlint]: ⚠️ Could not read GitHub event: ${err}`);
+        }
+    }
+    return { from: 'HEAD~1', to: 'HEAD' };
+}
+async function runCommitlint() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.commitlint?.enabled === false) {
+        utils_1.logger.info('[runCommitlint]: Disabled in pr-checkmate.json, skipping');
+        result_collector_1.resultCollector.register('Commitlint', 'skip');
+        return;
+    }
+    utils_1.logger.info('[runCommitlint]: 📝 Running commitlint...');
+    const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
+    const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
+    let tempConfigFile = null;
+    const { from, to } = await getCommitRange();
+    const args = ['--from', from, '--to', to, '--verbose'];
+    try {
+        if (hasLocal) {
+            utils_1.logger.info('[runCommitlint]: Using local commitlint config');
+        }
+        else {
+            const types = cfg.commitlint?.types ?? DEFAULT_TYPES;
+            tempConfigFile = buildTempConfig(types);
+            utils_1.logger.info(`[runCommitlint]: Using pr-checkmate commitlint config (types: ${types.join(', ')})`);
+            args.push('--config', tempConfigFile);
+        }
+        const result = await (0, execa_1.execa)(process.execPath, [commitlintBin, ...args], {
+            reject: false,
+            stdio: 'inherit',
+        });
+        if (result.exitCode === 0) {
+            utils_1.logger.info('[runCommitlint]: ✅ All commits follow the convention');
+            result_collector_1.resultCollector.register('Commitlint', 'pass');
+        }
+        else {
+            utils_1.logger.warn('[runCommitlint]: ⚠️ Some commits do not follow the convention (see above)');
+            result_collector_1.resultCollector.register('Commitlint', 'warn', 'commit message violations found');
+        }
+    }
+    finally {
+        if (tempConfigFile && node_fs_1.default.existsSync(tempConfigFile)) {
+            node_fs_1.default.unlinkSync(tempConfigFile);
+        }
+    }
+}

package/dist/scripts/diff-security.js

@@ -0,0 +1,199 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDiffSecurity = runDiffSecurity;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
+const loader_1 = require("../config/loader");
+const node_fs_1 = __importDefault(require("node:fs"));
+const SECURITY_PATTERNS = [
+    // XSS vectors
+    {
+        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
+        label: 'dangerouslySetInnerHTML (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
+        label: 'innerHTML assignment (XSS risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*document\.write\s*\(/,
+        label: 'document.write() (XSS risk)',
+        severity: 'error',
+    },
+    // Code injection
+    {
+        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
+        label: 'new Function() (code injection risk)',
+        severity: 'error',
+    },
+    // Prototype pollution
+    {
+        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
+        label: '__proto__ mutation (prototype pollution)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
+        label: 'constructor.prototype access (prototype pollution)',
+        severity: 'warn',
+    },
+    // Weak crypto (Node.js built-ins)
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
+        label: 'MD5 (weak hash — use sha256 or stronger)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
+        label: 'SHA-1 (weak hash — use sha256 or stronger)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
+        label: 'deprecated createDecipher() — use createDecipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
+        label: 'deprecated createCipher() — use createCipheriv()',
+        severity: 'warn',
+    },
+    // CORS misconfiguration
+    {
+        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
+        label: "CORS wildcard origin: '*' (allows any domain)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
+        severity: 'warn',
+    },
+    // Insecure HTTP (non-HTTPS external calls)
+    {
+        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
+        label: 'Insecure HTTP (non-HTTPS) in external call',
+        severity: 'warn',
+    },
+    // Command injection risk — exec/spawn with string concatenation
+    {
+        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
+        label: 'exec/spawn with template literal (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
+        label: 'exec/spawn with string concatenation (command injection risk)',
+        severity: 'error',
+    },
+    // SQL injection — template literals in query strings
+    {
+        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
+        label: 'SQL query with template literal interpolation (SQL injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(SELECT|INSERT|UPDATE|DELETE|WHERE)[^'"]*['"\s]*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+function readBaseSha() {
+    const eventName = process.env.GITHUB_EVENT_NAME;
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (eventName !== 'pull_request' || !eventPath || !node_fs_1.default.existsSync(eventPath)) {
+        return null;
+    }
+    try {
+        const event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
+        return event?.pull_request?.base?.sha ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function runDiffSecurity() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.diffSecurity?.enabled === false) {
+        utils_1.logger.info('[runDiffSecurity]: Disabled in pr-checkmate.json, skipping');
+        result_collector_1.resultCollector.register('Diff Security', 'skip');
+        return;
+    }
+    utils_1.logger.info('[runDiffSecurity]: Scanning diff for security issues...');
+    const baseSha = readBaseSha();
+    if (!baseSha) {
+        utils_1.logger.info('[runDiffSecurity]: Not in GitHub PR context, skipping');
+        result_collector_1.resultCollector.register('Diff Security', 'skip');
+        return;
+    }
+    try {
+        const { stdout } = await (0, execa_1.execa)('git', [
+            'diff',
+            '--unified=0',
+            '--diff-filter=ACMR',
+            baseSha,
+            'HEAD',
+            '--',
+            '*.ts',
+            '*.tsx',
+            '*.js',
+            '*.jsx',
+            '*.mjs',
+            '*.cjs',
+        ]);
+        const lines = stdout.split('\n');
+        const errors = {};
+        const warnings = {};
+        for (const line of lines) {
+            for (const { pattern, label, severity } of SECURITY_PATTERNS) {
+                if (pattern.test(line)) {
+                    const bucket = severity === 'error' ? errors : warnings;
+                    if (!bucket[label])
+                        bucket[label] = [];
+                    bucket[label].push(line.slice(1).trim().substring(0, 120));
+                }
+            }
+        }
+        const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
+        const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
+        if (totalErrors === 0 && totalWarnings === 0) {
+            utils_1.logger.info('[runDiffSecurity]: ✅ No security issues detected in diff');
+            result_collector_1.resultCollector.register('Diff Security', 'pass');
+            return;
+        }
+        for (const [label, occurrences] of Object.entries(errors)) {
+            utils_1.logger.error(`[runDiffSecurity]: ❌ ${label}: ${occurrences.length} occurrence(s)`);
+            occurrences.slice(0, 3).forEach(line => utils_1.logger.error(`    ${line}`));
+            if (occurrences.length > 3)
+                utils_1.logger.error(`    ... and ${occurrences.length - 3} more`);
+        }
+        for (const [label, occurrences] of Object.entries(warnings)) {
+            utils_1.logger.warn(`[runDiffSecurity]: ⚠️ ${label}: ${occurrences.length} occurrence(s)`);
+            occurrences.slice(0, 3).forEach(line => utils_1.logger.warn(`    ${line}`));
+            if (occurrences.length > 3)
+                utils_1.logger.warn(`    ... and ${occurrences.length - 3} more`);
+        }
+        const parts = [];
+        if (totalErrors > 0)
+            parts.push(`${totalErrors} issue(s)`);
+        if (totalWarnings > 0)
+            parts.push(`${totalWarnings} warning(s)`);
+        const summary = parts.join(', ');
+        result_collector_1.resultCollector.register('Diff Security', 'warn', summary);
+    }
+    catch (err) {
+        utils_1.logger.warn(`[runDiffSecurity]: ⚠️ Could not analyze diff\n${err}`);
+        result_collector_1.resultCollector.register('Diff Security', 'skip');
+    }
+}

package/dist/scripts/diff-smell.js

@@ -11,7 +11,10 @@ const loader_1 = require("../config/loader");
 const node_fs_1 = __importDefault(require("node:fs"));
 const SMELL_PATTERNS = [
     // console.* calls added in diff (not in comments)
-    { pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/, label: 'console.*()' },
+    {
+        pattern: /^\+(?!\+)(?:[^/]|\/[^/]).*\bconsole\.(log|error|warn|debug|info)\s*\(/,
+        label: 'console.*()',
+    },
     { pattern: /^\+(?!\+).*\bdebugger\b/, label: 'debugger statement' },
     { pattern: /^\+\s*\/\/\s*TODO\b/i, label: 'TODO comment' },
     { pattern: /^\+\s*\/\/\s*FIXME\b/i, label: 'FIXME comment' },

package/dist/scripts/duplicate-check.js

@@ -32,9 +32,10 @@ async function runDuplicateCheck() {
     // Fall back to src/ or project root when not in delta mode
     const srcPath = node_path_1.default.join(projectRoot, 'src');
     const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [projectRoot]);
+    const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'bin/jscpd');
     try {
-        const result = await (0, execa_1.execa)('npx', [
-            'jscpd',
+        const result = await (0, execa_1.execa)(process.execPath, [
+            jscpdBin,
             '--min-lines',
             String(minLines),
             '--min-tokens',

package/dist/scripts/index.js

@@ -30,6 +30,9 @@ const typecheck_1 = require("./typecheck");
 const diff_smell_1 = require("./diff-smell");
 const pr_body_1 = require("./pr-body");
 const duplicate_check_1 = require("./duplicate-check");
+const commitlint_1 = require("./commitlint");
+const diff_security_1 = require("./diff-security");
+const sensitive_file_guard_1 = require("./sensitive-file-guard");
 const pr_summary_1 = require("./pr-summary");
 const utils_1 = require("../utils");
 const result_collector_1 = require("../utils/result-collector");
@@ -49,6 +52,9 @@ __exportStar(require("./typecheck"), exports);
 __exportStar(require("./diff-smell"), exports);
 __exportStar(require("./pr-body"), exports);
 __exportStar(require("./duplicate-check"), exports);
+__exportStar(require("./commitlint"), exports);
+__exportStar(require("./diff-security"), exports);
+__exportStar(require("./sensitive-file-guard"), exports);
 __exportStar(require("./pr-summary"), exports);
 /**
  * Wraps a blocking check: registers 'pass' on success, 'fail' on throw (and re-throws).
@@ -101,8 +107,11 @@ async function runJob(jobName) {
                     trackSoftCheck('Markdown', markdown_lint_1.runMarkdownLint),
                     trackSoftCheck('Spellcheck', spellcheck_1.runSpellcheck),
                     (0, diff_smell_1.runDiffSmell)(),
+                    (0, diff_security_1.runDiffSecurity)(),
+                    (0, sensitive_file_guard_1.runSensitiveFileGuard)(),
                     (0, pr_body_1.runPrBodyCheck)(),
                     (0, duplicate_check_1.runDuplicateCheck)(),
+                    (0, commitlint_1.runCommitlint)(),
                 ]);
                 // Phase 3: prettier last — may write files, then auto-commit in CI
                 await trackSoftCheck('Prettier', prettier_autoformat_1.runPrettier);
@@ -158,8 +167,17 @@ async function runJob(jobName) {
             case 'duplicate':
                 await (0, duplicate_check_1.runDuplicateCheck)();
                 break;
+            case 'commitlint':
+                await (0, commitlint_1.runCommitlint)();
+                break;
+            case 'diff-security':
+                await (0, diff_security_1.runDiffSecurity)();
+                break;
+            case 'sensitive-files':
+                await (0, sensitive_file_guard_1.runSensitiveFileGuard)();
+                break;
             default:
-                utils_1.logger.warn(`[runJob]: Unknown job "${jobName}". Available: all, lint, deps, npm-audit, prettier, spellcheck, security, circular, license, pr-size, pr-title, outdated, markdown, typecheck, diff-smell, pr-body, duplicate`);
+                utils_1.logger.warn(`[runJob]: Unknown job "${jobName}". Available: all, lint, deps, npm-audit, prettier, spellcheck, security, circular, license, pr-size, pr-title, outdated, markdown, typecheck, diff-smell, diff-security, sensitive-files, pr-body, duplicate, commitlint`);
         }
     }
     catch (err) {

package/dist/scripts/lint.js

@@ -9,12 +9,10 @@ const utils_1 = require("../utils");
 const delta_1 = require("../utils/delta");
 const execa_1 = require("execa");
 const node_path_1 = __importDefault(require("node:path"));
-/**
- * Detect ESLint major version to choose appropriate config format
- */
 async function getESLintMajorVersion() {
     try {
-        const { stdout } = await (0, execa_1.execa)('npx', ['eslint', '--version']);
+        const eslintBin = (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js');
+        const { stdout } = await (0, execa_1.execa)(process.execPath, [eslintBin, '--version']);
         const match = stdout.match(/v?(\d+)\./);
         return match ? parseInt(match[1], 10) : 8;
     }
@@ -24,6 +22,7 @@ async function getESLintMajorVersion() {
 }
 async function runLint() {
     utils_1.logger.info('[runLint]: 🔍 Running ESLint...');
+    const eslintBin = (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js');
     const projectRoot = process.cwd();
     const sourcePath = (0, config_1.getSourcePath)();
     const sourceFullPath = node_path_1.default.join(projectRoot, sourcePath);
@@ -39,7 +38,7 @@ async function runLint() {
     let args;
     if (hasLocal) {
         utils_1.logger.info(`[runLint]: Using local ESLint config (checking: ${sourcePath})`);
-        args = ['eslint', ...targets, '--ext', '.ts,.tsx,.js,.jsx', '--fix'];
+        args = [...targets, '--ext', '.ts,.tsx,.js,.jsx', '--fix'];
     }
     else {
         utils_1.logger.info(`[runLint]: Using pr-checkmate ESLint config (checking: ${sourcePath})`);
@@ -48,11 +47,11 @@ async function runLint() {
         const configFile = eslintVersion >= 9 ? 'eslint.config.mjs' : '.eslintrc.js';
         const configPath = (0, config_1.getPackageConfigPath)(configFile);
         utils_1.logger.info(`[runLint]: Detected ESLint v${eslintVersion}, using ${configFile}`);
-        args = ['eslint', ...targets, '--ext', '.ts,.tsx,.js,.jsx', '--fix', '--config', configPath];
+        args = [...targets, '--ext', '.ts,.tsx,.js,.jsx', '--fix', '--config', configPath];
     }
     config_1.IGNORE_PATTERNS.forEach(p => args.push('--ignore-pattern', p));
     try {
-        await (0, execa_1.execa)('npx', args, { stdio: 'inherit' });
+        await (0, execa_1.execa)(process.execPath, [eslintBin, ...args], { stdio: 'inherit' });
         utils_1.logger.info('[runLint]: ✅ ESLint passed');
     }
     catch (err) {

package/dist/scripts/markdown-lint.js

@@ -43,8 +43,14 @@ async function runMarkdownLint() {
     else {
         // Use git ls-files to get only tracked .md files — naturally excludes .gitignore and untracked dirs
         try {
-            const { stdout } = await (0, execa_1.execa)('git', ['ls-files', '*.md', '**/*.md'], { cwd: root, reject: false });
-            const tracked = stdout.split('\n').map(f => f.trim()).filter(f => f.endsWith('.md'));
+            const { stdout } = await (0, execa_1.execa)('git', ['ls-files', '*.md', '**/*.md'], {
+                cwd: root,
+                reject: false,
+            });
+            const tracked = stdout
+                .split('\n')
+                .map(f => f.trim())
+                .filter(f => f.endsWith('.md'));
             targets = tracked.length > 0 ? tracked : [];
         }
         catch {
@@ -60,7 +66,12 @@ async function runMarkdownLint() {
     const hasUserRules = Object.keys(userRules).length > 0;
     let configArg;
     let tempConfigFile = null;
-    if ((0, config_1.hasLocalConfig)(['.markdownlint.json', '.markdownlint.jsonc', '.markdownlint.yaml', '.markdownlint.yml'])) {
+    if ((0, config_1.hasLocalConfig)([
+        '.markdownlint.json',
+        '.markdownlint.jsonc',
+        '.markdownlint.yaml',
+        '.markdownlint.yml',
+    ])) {
         utils_1.logger.info('[runMarkdownLint]: 📋 Using local .markdownlint config');
         configArg = [];
     }
@@ -79,21 +90,29 @@ async function runMarkdownLint() {
     const extraIgnores = (userConfig.ignores ?? []).flatMap(p => ['--ignore', p]);
     const gitignorePath = node_path_1.default.join(root, '.gitignore');
     const ignorePath = node_fs_1.default.existsSync(gitignorePath) ? ['--ignore-path', gitignorePath] : [];
+    const markdownlintBin = (0, utils_1.resolvePackageBin)('markdownlint-cli', 'markdownlint.js');
     const args = [
-        'markdownlint',
         '--fix',
         ...targets,
         ...configArg,
         ...ignorePath,
-        '--ignore', 'node_modules',
-        '--ignore', 'dist',
-        '--ignore', 'coverage',
-        '--ignore', 'graphify-out',
-        '--ignore', '.claude',
+        '--ignore',
+        'node_modules',
+        '--ignore',
+        'dist',
+        '--ignore',
+        'coverage',
+        '--ignore',
+        'graphify-out',
+        '--ignore',
+        '.claude',
         ...extraIgnores,
     ];
     try {
-        const result = await (0, execa_1.execa)('npx', args, { reject: false, stdio: 'inherit' });
+        const result = await (0, execa_1.execa)(process.execPath, [markdownlintBin, ...args], {
+            reject: false,
+            stdio: 'inherit',
+        });
         if (result.exitCode === 0) {
             utils_1.logger.info('[runMarkdownLint]: ✅ Markdown lint passed');
         }

package/dist/scripts/pr-title-lint.js

@@ -29,10 +29,10 @@ async function runPrTitleLint() {
     }
     const title = pr.title;
     if (!CONVENTIONAL_PREFIX.test(title)) {
-        utils_1.logger.warn(`[runPrTitleLint]: ⚠️ PR title doesn't follow Conventional Commits`);
+        utils_1.logger.warn("[runPrTitleLint]: ⚠️ PR title doesn't follow Conventional Commits");
         utils_1.logger.warn(`  Got:      "${title}"`);
-        utils_1.logger.warn(`  Expected: type(scope): description`);
-        utils_1.logger.warn(`  Types:    feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert`);
+        utils_1.logger.warn('  Expected: type(scope): description');
+        utils_1.logger.warn('  Types:    feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert');
         // warning only — teams may not use Conventional Commits
         return;
     }

package/dist/scripts/prettier-autoformat.js

@@ -87,18 +87,19 @@ async function runPrettier() {
     ]);
     let args;
     let tempConfig = null;
+    const prettierBin = (0, utils_1.resolvePackageBin)('prettier', 'bin/prettier.cjs');
     if (hasLocal) {
         utils_1.logger.info(`[runPrettier]: Using local Prettier config (checking: ${sourcePath})`);
-        args = ['prettier', '--write', ...targets, '--ignore-path', ignorePath];
+        args = ['--write', ...targets, '--ignore-path', ignorePath];
     }
     else {
         utils_1.logger.info(`[runPrettier]: Using pr-checkmate Prettier config (checking: ${sourcePath})`);
         // Create temporary config with merged settings
         tempConfig = createTempPrettierConfig();
-        args = ['prettier', '--write', ...targets, '--config', tempConfig, '--ignore-path', ignorePath];
+        args = ['--write', ...targets, '--config', tempConfig, '--ignore-path', ignorePath];
     }
     try {
-        await (0, execa_1.execa)('npx', args, { stdio: 'inherit' });
+        await (0, execa_1.execa)(process.execPath, [prettierBin, ...args], { stdio: 'inherit' });
         utils_1.logger.info('[runPrettier]: ✅ Prettier completed');
     }
     catch (err) {

package/dist/scripts/security.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runSecurityScan = runSecurityScan;
 const execa_1 = require("execa");
 const utils_1 = require("../utils");
+const config_1 = require("../config");
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 /**
  * Get HEAD SHA from git
  */
@@ -49,18 +49,6 @@ async function getBaseSha() {
         return null;
     }
 }
-/**
- * Check if gitleaks-secret-scanner is installed locally
- */
-function getGitleaksCommand() {
-    const localPath = node_path_1.default.join(process.cwd(), 'node_modules', '.bin', 'gitleaks-secret-scanner');
-    if (node_fs_1.default.existsSync(localPath)) {
-        utils_1.logger.info('[getGitleaksCommand]: Using local gitleaks-secret-scanner');
-        return localPath;
-    }
-    utils_1.logger.info('[getGitleaksCommand]: Using npx gitleaks-secret-scanner');
-    return 'npx';
-}
 /**
  * Run security scan for secrets
  */
@@ -80,11 +68,18 @@ async function runSecurityScan() {
             ...(headSha && { HEAD_SHA: headSha }),
             ...(baseSha && { BASE_SHA: baseSha }),
         };
-        const cmd = getGitleaksCommand();
-        const args = cmd === 'npx' ? ['gitleaks-secret-scanner', '--diff-mode', 'ci'] : ['--diff-mode', 'ci'];
-        utils_1.logger.info(`Running: ${cmd} ${args.join(' ')}`);
+        const gitleaksBin = (0, utils_1.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'bin/cli.js');
+        const hasClientConfig = (0, config_1.hasLocalConfig)([
+            '.gitleaks.toml',
+            'gitleaks.toml',
+            '.gitleaks/config.toml',
+        ]);
+        const gitleaksArgs = ['--diff-mode', 'ci'];
+        if (!hasClientConfig) {
+            gitleaksArgs.push('--config', (0, config_1.getPackageConfigPath)('gitleaks.toml'));
+        }
         utils_1.logger.info(`HEAD_SHA=${env.HEAD_SHA || 'auto-detect'}, BASE_SHA=${env.BASE_SHA || 'auto-detect'}`);
-        await (0, execa_1.execa)(cmd, args, {
+        await (0, execa_1.execa)(process.execPath, [gitleaksBin, ...gitleaksArgs], {
             stdio: 'inherit',
             env,
         });

package/dist/scripts/sensitive-file-guard.js

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSensitiveFileGuard = runSensitiveFileGuard;
+const execa_1 = require("execa");
+const utils_1 = require("../utils");
+const result_collector_1 = require("../utils/result-collector");
+const loader_1 = require("../config/loader");
+const node_fs_1 = __importDefault(require("node:fs"));
+const SENSITIVE_CATEGORIES = [
+    {
+        label: 'Environment files (.env)',
+        patterns: [/^\.env$/, /^\.env\..+/, /\/.env$/, /\/.env\..+/],
+        severity: 'error',
+    },
+    {
+        label: 'Private keys and certificates',
+        patterns: [/\.(pem|key|p12|pfx|crt|cer|der|jks|keystore)$/i],
+        severity: 'error',
+    },
+    {
+        label: 'CI/CD pipeline config',
+        patterns: [
+            /^\.github\/workflows\//,
+            /^\.gitlab-ci\.yml$/,
+            /^\.circleci\//,
+            /^\.travis\.yml$/,
+            /^Jenkinsfile$/,
+            /^\.buildkite\//,
+        ],
+        severity: 'warn',
+    },
+    {
+        label: 'Authentication / authorization middleware',
+        patterns: [
+            /\/(middleware|guards?|interceptors?)\/(auth|jwt|session|token|oauth|rbac)/i,
+            /\/(auth|jwt|session)\.(ts|js|mjs|cjs)$/i,
+        ],
+        severity: 'warn',
+    },
+    {
+        label: 'Infrastructure and deployment config',
+        patterns: [
+            /^(docker-compose|compose)\.(yml|yaml)$/,
+            /^Dockerfile(\..+)?$/,
+            /^terraform\//,
+            /\.tf$/,
+            /^\.?kubeconfig$/,
+            /^helm\//,
+        ],
+        severity: 'warn',
+    },
+    {
+        label: 'Package manager lockfiles (dependency supply chain)',
+        patterns: [/^package-lock\.json$/, /^yarn\.lock$/, /^pnpm-lock\.yaml$/],
+        severity: 'warn',
+    },
+];
+function readBaseSha() {
+    const eventName = process.env.GITHUB_EVENT_NAME;
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (eventName !== 'pull_request' || !eventPath || !node_fs_1.default.existsSync(eventPath)) {
+        return null;
+    }
+    try {
+        const event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
+        return event?.pull_request?.base?.sha ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function matchesCategory(filePath, category) {
+    return category.patterns.some(p => p.test(filePath));
+}
+async function runSensitiveFileGuard() {
+    const cfg = (0, loader_1.loadProjectConfig)();
+    if (cfg.sensitiveFileGuard?.enabled === false) {
+        utils_1.logger.info('[runSensitiveFileGuard]: Disabled in pr-checkmate.json, skipping');
+        result_collector_1.resultCollector.register('Sensitive Files', 'skip');
+        return;
+    }
+    utils_1.logger.info('[runSensitiveFileGuard]: Checking for sensitive file changes...');
+    const baseSha = readBaseSha();
+    if (!baseSha) {
+        utils_1.logger.info('[runSensitiveFileGuard]: Not in GitHub PR context, skipping');
+        result_collector_1.resultCollector.register('Sensitive Files', 'skip');
+        return;
+    }
+    try {
+        const { stdout } = await (0, execa_1.execa)('git', [
+            'diff',
+            '--name-only',
+            '--diff-filter=ACMRD',
+            baseSha,
+            'HEAD',
+        ]);
+        const changedFiles = stdout.split('\n').filter(Boolean);
+        if (changedFiles.length === 0) {
+            utils_1.logger.info('[runSensitiveFileGuard]: ✅ No file changes to inspect');
+            result_collector_1.resultCollector.register('Sensitive Files', 'pass');
+            return;
+        }
+        const errors = {};
+        const warnings = {};
+        for (const filePath of changedFiles) {
+            for (const category of SENSITIVE_CATEGORIES) {
+                if (matchesCategory(filePath, category)) {
+                    const bucket = category.severity === 'error' ? errors : warnings;
+                    if (!bucket[category.label])
+                        bucket[category.label] = [];
+                    bucket[category.label].push(filePath);
+                }
+            }
+        }
+        const totalErrors = Object.values(errors).reduce((s, a) => s + a.length, 0);
+        const totalWarnings = Object.values(warnings).reduce((s, a) => s + a.length, 0);
+        if (totalErrors === 0 && totalWarnings === 0) {
+            utils_1.logger.info('[runSensitiveFileGuard]: ✅ No sensitive file changes detected');
+            result_collector_1.resultCollector.register('Sensitive Files', 'pass');
+            return;
+        }
+        for (const [label, files] of Object.entries(errors)) {
+            utils_1.logger.error(`[runSensitiveFileGuard]: ❌ ${label}:`);
+            files.forEach(f => utils_1.logger.error(`    ${f}`));
+        }
+        for (const [label, files] of Object.entries(warnings)) {
+            utils_1.logger.warn(`[runSensitiveFileGuard]: ⚠️ ${label}:`);
+            files.forEach(f => utils_1.logger.warn(`    ${f}`));
+        }
+        const parts = [];
+        if (totalErrors > 0)
+            parts.push(`${totalErrors} sensitive file(s) changed`);
+        if (totalWarnings > 0)
+            parts.push(`${totalWarnings} notable file(s) changed`);
+        const summary = parts.join(', ');
+        result_collector_1.resultCollector.register('Sensitive Files', 'warn', summary);
+    }
+    catch (err) {
+        utils_1.logger.warn(`[runSensitiveFileGuard]: ⚠️ Could not check file changes\n${err}`);
+        result_collector_1.resultCollector.register('Sensitive Files', 'skip');
+    }
+}

package/dist/scripts/spellcheck.js

@@ -32,11 +32,15 @@ function loadUserCspellConfig() {
  */
 function createTempCspellConfig() {
     const packageConfigPath = (0, config_1.getPackageConfigPath)('cspell.json');
+    const packageConfigDir = node_path_1.default.dirname(packageConfigPath);
     const defaultConfig = JSON.parse(node_fs_1.default.readFileSync(packageConfigPath, 'utf-8'));
     const userConfig = loadUserCspellConfig();
+    // Resolve relative import paths to absolute so they work from any client cwd
+    const resolvedImports = (defaultConfig.import ?? []).map(p => p.startsWith('.') ? node_path_1.default.resolve(packageConfigDir, p) : p);
     // Merge configurations
     const mergedConfig = {
         ...defaultConfig,
+        import: resolvedImports,
         words: [...defaultConfig.words, ...(userConfig.words || [])],
         ignorePaths: [...defaultConfig.ignorePaths, ...(userConfig.ignorePaths || [])],
         ignoreRegExpList: [...defaultConfig.ignoreRegExpList, ...(userConfig.ignoreRegExpList || [])],
@@ -81,18 +85,19 @@ async function runSpellcheck() {
     const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json']);
     let args;
     let tempConfigPath = null;
+    const cspellBin = (0, utils_1.resolvePackageBin)('cspell', 'bin.mjs');
     if (hasLocal) {
         utils_1.logger.info(`📋 Using local cspell config (checking: ${sourcePath})`);
-        args = ['cspell', ...patterns, '--no-progress'];
+        args = [...patterns, '--no-progress'];
     }
     else {
         utils_1.logger.info(`[runSpellcheck]: Using pr-checkmate cspell config (checking: ${sourcePath})`);
         // Create temporary config with merged settings
         tempConfigPath = createTempCspellConfig();
-        args = ['cspell', ...patterns, '--config', tempConfigPath, '--no-progress'];
+        args = [...patterns, '--config', tempConfigPath, '--no-progress'];
     }
     try {
-        await (0, execa_1.execa)('npx', args, { stdio: 'inherit' });
+        await (0, execa_1.execa)(process.execPath, [cspellBin, ...args], { stdio: 'inherit' });
         utils_1.logger.info('[runSpellcheck]: ✅ Spellcheck passed');
     }
     catch (err) {

package/dist/scripts/typecheck.js

@@ -21,7 +21,8 @@ async function runTypecheck() {
         utils_1.logger.info('[runTypecheck]: No tsconfig.json found, skipping');
         return;
     }
-    const result = await (0, execa_1.execa)('npx', ['tsc', '--noEmit'], { reject: false });
+    const tscBin = (0, utils_1.resolvePackageBin)('typescript', 'bin/tsc');
+    const result = await (0, execa_1.execa)(process.execPath, [tscBin, '--noEmit'], { reject: false });
     if (result.exitCode !== 0) {
         const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
         const errorCount = (output.match(/error TS\d+/g) ?? []).length;

package/dist/utils/index.js

@@ -23,6 +23,7 @@ const logger_1 = require("./logger");
 __exportStar(require("./logger"), exports);
 __exportStar(require("./delta"), exports);
 __exportStar(require("./result-collector"), exports);
+__exportStar(require("./resolve-bin"), exports);
 function cleanupTempFile(filePath) {
     try {
         if (node_fs_1.default.existsSync(filePath)) {

package/dist/utils/resolve-bin.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePackageBin = resolvePackageBin;
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
+/**
+ * Resolves a binary path for a bundled package, bypassing exports map restrictions.
+ *
+ * Strategy (tries each in order):
+ * 1. Direct subpath — fast path for packages that explicitly export their bin
+ * 2. Via package.json — for packages that export ./package.json but not the bin subpath (e.g. eslint)
+ * 3. Walk up from main entry — for packages that export neither (e.g. cspell)
+ */
+function resolvePackageBin(pkgName, binRelPath) {
+    // 1. Direct subpath
+    try {
+        return require.resolve(`${pkgName}/${binRelPath}`);
+    }
+    catch { }
+    // 2. Via package.json
+    try {
+        const pkgJsonPath = require.resolve(`${pkgName}/package.json`);
+        return node_path_1.default.join(node_path_1.default.dirname(pkgJsonPath), binRelPath);
+    }
+    catch { }
+    // 3. Walk up from main entry to find package root by matching package name
+    const main = require.resolve(pkgName);
+    let dir = node_path_1.default.dirname(main);
+    while (dir !== node_path_1.default.dirname(dir)) {
+        const pkgJsonPath = node_path_1.default.join(dir, 'package.json');
+        if (node_fs_1.default.existsSync(pkgJsonPath)) {
+            try {
+                const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
+                if (pkg.name === pkgName) {
+                    return node_path_1.default.join(dir, binRelPath);
+                }
+            }
+            catch { }
+        }
+        dir = node_path_1.default.dirname(dir);
+    }
+    throw new Error(`Cannot resolve binary "${binRelPath}" for package "${pkgName}"`);
+}

package/gitleaks.toml

@@ -0,0 +1,10 @@
+title = "pr-checkmate gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "pr-checkmate global allowlist"
+paths = [
+    '''(?:^|/)__tests__(?:/.*)?$''',
+]

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.21.5",
+    "version": "1.21.7",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -27,6 +27,7 @@
         "cspell.json",
         "src/config/pr-checkmate-workflow.yml",
         ".markdownlint.json",
+        "gitleaks.toml",
         "LICENSE"
     ],
     "scripts": {
@@ -59,6 +60,8 @@
     "author": "Artur Polishchuk",
     "license": "LicenseRef-Proprietary",
     "dependencies": {
+        "@commitlint/cli": "^21.2.0",
+        "@commitlint/config-conventional": "^21.2.0",
         "@cspell/dict-es-es": "^3.0.8",
         "@cspell/dict-fr-fr": "^2.2.2",
         "@cspell/dict-he": "^4.0.2",
@@ -83,9 +86,5 @@
     },
     "devDependencies": {
         "standard-version": "^9.5.0"
-    },
-    "peerDependencies": {
-        "eslint": "^9.26.0",
-        "prettier": ">=3.0.0"
     }
 }

package/src/config/cspell.json

@@ -9,6 +9,8 @@
     "./node_modules/@cspell/dict-es-es/cspell-ext.json"
   ],
   "words": [
+    "ACMR",
+    "ACMRD",
     "accona",
     "Accona",
     "acepto",
@@ -41,6 +43,7 @@
     "Catrice",
     "Cerrar",
     "checkmate",
+    "circleci",
     "coincidan",
     "como",
     "comprobante",
@@ -85,6 +88,7 @@
     "gastos",
     "Gastos",
     "Gestión",
+    "gitlab",
     "gitleaks",
     "givatayim",
     "Givatayim",
@@ -113,9 +117,11 @@
     "israel",
     "jerusalem",
     "kfar",
+    "kubeconfig",
     "Kfar",
     "Kolomiets",
     "leído",
+    "lockfiles",
     "manera",
     "mavox",
     "Mavox",
@@ -182,6 +188,7 @@
     "sistema",
     "sultansadikov",
     "telaviv",
+    "travis",
     "Términos",
     "Teudat",
     "Tiempo",