pr-checkmate 1.22.7 → 1.23.0

package/dist/core/checks/{duplicate-check.d.ts → quality/duplicate-check.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const duplicateCheck: Check;

package/dist/core/checks/{duplicate-check.js → quality/duplicate-check.js}

@@ -1,16 +1,12 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.duplicateCheck = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const constants_1 = require("../../config/constants");
-const utils_1 = require("../../utils");
-const delta_1 = require("../../utils/delta");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const constants_1 = require("../../../config/constants");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
 // Always excluded regardless of client config — scanning these never yields
 // meaningful production duplication. Config files (eslint/*.config.*) are data,
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
@@ -44,11 +40,11 @@ exports.duplicateCheck = {
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const changedFiles = await (0, delta_1.getChangedFiles)(['.ts', '.tsx', '.js', '.jsx']);
-        if (changedFiles !== null && changedFiles.length === 0)
-            return (0, types_1.skip)('no relevant files changed');
-        const srcPath = node_path_1.default.join(ctx.cwd, 'src');
-        const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [ctx.cwd]);
+        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        if (targetPaths === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targetPaths.length === 0)
+            return (0, types_1.skip)('no relevant files');
         const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'run-jscpd.js');
         // Client-configurable exclusions (pr-checkmate.json `duplicate.ignore`),
         // defaulting to test files/folders, appended to the always-on base ignores.

package/dist/core/checks/quality/license-header.d.ts

@@ -0,0 +1,7 @@
+import { Check } from '../../types';
+/**
+ * Requires a license/copyright header (a configured regex) in the first N lines
+ * of newly ADDED source files. Opt-in — needs `licenseHeader.pattern`; does
+ * nothing until a repo configures one. Advisory (warn).
+ */
+export declare const licenseHeaderCheck: Check;

package/dist/core/checks/quality/license-header.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.licenseHeaderCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+/** Source extensions a license header is expected on. */
+const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|kt|java|go|rs|cs|rb|php|swift|c|cc|cpp|h|hpp)$/i;
+const DEFAULT_HEADER_LINES = 10;
+/**
+ * Requires a license/copyright header (a configured regex) in the first N lines
+ * of newly ADDED source files. Opt-in — needs `licenseHeader.pattern`; does
+ * nothing until a repo configures one. Advisory (warn).
+ */
+exports.licenseHeaderCheck = {
+    name: 'License Header',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.licenseHeader?.enabled === true && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        const patternSrc = ctx.config.licenseHeader?.pattern;
+        if (!patternSrc)
+            return (0, types_1.skip)('no licenseHeader.pattern configured');
+        let header;
+        try {
+            header = new RegExp(patternSrc);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[License Header]: ⚠️ invalid pattern\n${err}`);
+            return (0, types_1.skip)('invalid licenseHeader.pattern');
+        }
+        const maxLines = ctx.config.licenseHeader?.lines ?? DEFAULT_HEADER_LINES;
+        let added;
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--name-only', '--diff-filter=A', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+            added = stdout
+                .split('\n')
+                .filter(Boolean)
+                .filter(f => SOURCE_EXT.test(f));
+        }
+        catch (err) {
+            utils_1.logger.warn(`[License Header]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+        const missing = [];
+        for (const file of added) {
+            let head;
+            try {
+                head = node_fs_1.default
+                    .readFileSync(node_path_1.default.join(ctx.cwd, file), 'utf-8')
+                    .split('\n')
+                    .slice(0, maxLines)
+                    .join('\n');
+            }
+            catch {
+                continue; // removed/renamed between diff and read
+            }
+            if (!header.test(head))
+                missing.push(file);
+        }
+        if (missing.length === 0)
+            return (0, types_1.pass)();
+        missing.slice(0, 10).forEach(f => utils_1.logger.warn(`[License Header]: ⚠️ missing header: ${f}`));
+        if (missing.length > 10)
+            utils_1.logger.warn(`[License Header]: ⚠️ ... and ${missing.length - 10} more`);
+        return (0, types_1.warn)(`${missing.length} new source file(s) missing the license header`);
+    },
+};

package/dist/core/checks/{markdown-lint.d.ts → quality/markdown-lint.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const markdownLintCheck: Check;

package/dist/core/checks/{markdown-lint.js → quality/markdown-lint.js}

@@ -7,11 +7,11 @@ exports.markdownLintCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../config");
-const utils_1 = require("../../utils");
-const delta_1 = require("../../utils/delta");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
 function loadUserMarkdownConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (!node_fs_1.default.existsSync(configPath))
@@ -31,21 +31,6 @@ function buildMergedConfig(bundledConfigPath, userRules) {
     node_fs_1.default.writeFileSync(tmpFile, JSON.stringify(merged, null, 2));
     return tmpFile;
 }
-async function resolveTargets(cwd) {
-    const changedFiles = await (0, delta_1.getChangedFiles)(['.md', '.mdx']);
-    if (changedFiles !== null)
-        return changedFiles;
-    try {
-        const { stdout } = await (0, execa_1.execa)('git', ['ls-files', '*.md', '**/*.md'], { cwd, reject: false });
-        return stdout
-            .split('\n')
-            .map(f => f.trim())
-            .filter(f => f.endsWith('.md'));
-    }
-    catch {
-        return [`${cwd}/**/*.md`];
-    }
-}
 exports.markdownLintCheck = {
     name: 'Markdown',
     phase: 'informational',
@@ -53,7 +38,9 @@ exports.markdownLintCheck = {
         return true;
     },
     async run(ctx) {
-        const targets = await resolveTargets(ctx.cwd);
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.md', '*.mdx']);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.skip)('no markdown files');
         const userConfig = loadUserMarkdownConfig(ctx.cwd);

package/dist/core/checks/{spellcheck.d.ts → quality/spellcheck.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const spellcheckCheck: Check;

package/dist/core/checks/{spellcheck.js → quality/spellcheck.js}

@@ -6,11 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.spellcheckCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../config");
-const utils_1 = require("../../utils");
-const delta_1 = require("../../utils/delta");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
 function loadUserCspellConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (!node_fs_1.default.existsSync(configPath))
@@ -57,20 +57,12 @@ exports.spellcheckCheck = {
         return true;
     },
     async run(ctx) {
-        const sourcePath = (0, config_1.getSourcePath)();
-        const changedFiles = await (0, delta_1.getChangedFiles)([
-            '.ts',
-            '.tsx',
-            '.js',
-            '.jsx',
-            '.md',
-            '.mdx',
-            '.json',
-        ]);
-        const patterns = changedFiles ?? [
-            node_path_1.default.join(ctx.cwd, sourcePath, '**/*.{ts,tsx,js,jsx,md,mdx,json}'),
-            ...config_1.IGNORE_PATTERNS.map(p => `--exclude=${p}`),
-        ];
+        const files = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)());
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        if (files.length === 0)
+            return (0, types_1.pass)('no files to spellcheck');
+        const patterns = [...files, ...config_1.IGNORE_PATTERNS.map(p => `--exclude=${p}`)];
         const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json']);
         let tempConfigPath = null;
         const cspellBin = (0, utils_1.resolvePackageBin)('cspell', 'bin.mjs');

package/dist/core/checks/{diff-security.d.ts → security/diff-security.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const diffSecurityCheck: Check;

package/dist/core/checks/security/diff-security.js

@@ -0,0 +1,262 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffSecurityCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
+const SHA1_LABEL = 'SHA-1 (weak hash — use sha256 or stronger)';
+const SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
+        label: 'dangerouslySetInnerHTML (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
+        label: 'innerHTML assignment (XSS risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*document\.write\s*\(/,
+        label: 'document.write() (XSS risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
+        label: 'new Function() (code injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
+        label: '__proto__ mutation (prototype pollution)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
+        label: 'constructor.prototype access (prototype pollution)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
+        label: 'deprecated createDecipher() — use createDecipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
+        label: 'deprecated createCipher() — use createCipheriv()',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
+        label: "CORS wildcard origin: '*' (allows any domain)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
+        label: 'Insecure HTTP (non-HTTPS) in external call',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
+        label: 'exec/spawn with template literal (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
+        label: 'exec/spawn with string concatenation (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
+        label: 'SQL query with template literal interpolation (SQL injection risk)',
+        severity: 'error',
+    },
+    {
+        // A quoted string that contains a whole SQL keyword, concatenated with a
+        // variable — the real injection shape. Word boundaries + the quote context
+        // stop identifiers like `insertions + deletions` from false-positiving.
+        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+/** Python-specific dangerous constructs, scanned in *.py diffs. */
+const PYTHON_SECURITY_PATTERNS = [
+    { pattern: /^\+(?!\+).*\beval\s*\(/, label: 'eval() (code injection risk)', severity: 'error' },
+    { pattern: /^\+(?!\+).*\bexec\s*\(/, label: 'exec() (code injection risk)', severity: 'error' },
+    {
+        pattern: /^\+(?!\+).*\bos\.system\s*\(/,
+        label: 'os.system() (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bsubprocess\.\w+\([^)]*shell\s*=\s*True/,
+        label: 'subprocess with shell=True (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bpickle\.loads?\s*\(/,
+        label: 'pickle load (insecure deserialization)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\byaml\.load\s*\((?![^)]*Safe)/,
+        label: 'yaml.load without SafeLoader (unsafe deserialization)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bhashlib\.md5\s*\(/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bhashlib\.sha1\s*\(/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bverify\s*=\s*False\b/,
+        label: 'TLS verification disabled (verify=False)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"][^'"]*\b(SELECT|INSERT|UPDATE|DELETE)\b[^'"]*['"]\s*%\s*/i,
+        label: 'SQL string formatting (SQL injection risk)',
+        severity: 'error',
+    },
+];
+/** Go-specific dangerous constructs, scanned in *.go diffs. */
+const GO_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\bmd5\.New\s*\(/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bsha1\.New\s*\(/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*InsecureSkipVerify\s*:\s*true/,
+        label: 'InsecureSkipVerify: true (TLS verification disabled)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bexec\.Command\s*\([^)]*\+/,
+        label: 'exec.Command with string concatenation (command injection risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bfmt\.Sprintf\s*\([^)]*\b(SELECT|INSERT|UPDATE|DELETE)\b/i,
+        label: 'SQL built with fmt.Sprintf (SQL injection risk)',
+        severity: 'warn',
+    },
+    { pattern: /^\+(?!\+).*"crypto\/des"/, label: 'DES (weak cipher)', severity: 'warn' },
+];
+/** Kotlin/Java-specific dangerous constructs, scanned in *.kt/*.kts/*.java diffs. */
+const KOTLIN_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\bRuntime\.getRuntime\(\)\.exec\s*\(/,
+        label: 'Runtime.exec() (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bMessageDigest\.getInstance\s*\(\s*"(MD5|SHA-1)"/,
+        label: 'weak hash (MD5/SHA-1 via MessageDigest — use SHA-256+)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bCipher\.getInstance\s*\(\s*"(DES|.*ECB)/,
+        label: 'weak cipher (DES / ECB mode)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*ALLOW_ALL_HOSTNAME_VERIFIER/,
+        label: 'ALLOW_ALL_HOSTNAME_VERIFIER (TLS hostname verification disabled)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bObjectInputStream\b/,
+        label: 'ObjectInputStream (insecure deserialization risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*"[^"]*\b(SELECT|INSERT|UPDATE|DELETE)\b[^"]*"\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+const JS_GLOBS = ['*.ts', '*.tsx', '*.js', '*.jsx', '*.mjs', '*.cjs'];
+/** Scan a diff with a pattern set, accumulating matches into severity buckets. */
+function scanInto(stdout, patterns, errors, warnings) {
+    for (const line of stdout.split('\n')) {
+        // Match against the comment-stripped line so `eval(x)` in a comment isn't
+        // flagged, but report the original line for context.
+        const scanned = (0, findings_1.stripInlineComment)(line);
+        for (const { pattern, label, severity } of patterns) {
+            if (pattern.test(scanned)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+}
+exports.diffSecurityCheck = {
+    name: 'Diff Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            const errors = {};
+            const warnings = {};
+            // JS/TS patterns always run; language-specific sets scan their own globs
+            // only when that language is present, so a Python repo gets Python rules.
+            scanInto(await (0, findings_1.diffAddedLines)(ctx, JS_GLOBS), SECURITY_PATTERNS, errors, warnings);
+            if (ctx.languages.includes('python')) {
+                scanInto(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), PYTHON_SECURITY_PATTERNS, errors, warnings);
+            }
+            if (ctx.languages.includes('go')) {
+                scanInto(await (0, findings_1.diffAddedLines)(ctx, ['*.go']), GO_SECURITY_PATTERNS, errors, warnings);
+            }
+            if (ctx.languages.includes('kotlin')) {
+                const ktOut = await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']);
+                scanInto(ktOut, KOTLIN_SECURITY_PATTERNS, errors, warnings);
+            }
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Diff Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+                ignore: ctx.config.diffSecurity?.ignore,
+            });
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/security/dockerfile-security.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const dockerfileSecurityCheck: Check;

package/dist/core/checks/security/dockerfile-security.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dockerfileSecurityCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const DOCKERFILE_GLOBS = ['**/Dockerfile', '**/Dockerfile.*', '**/*.Dockerfile'];
+/** Common Dockerfile security smells, matched on added diff lines. */
+const DOCKER_PATTERNS = [
+    {
+        pattern: /^\+(?!\+)\s*FROM\s+\S+:latest\b/i,
+        label: 'FROM …:latest (pin the base image to a version/digest)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*USER\s+root\b/i,
+        label: 'USER root (run the container as a non-root user)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash)\b/i,
+        label: 'piping a download straight to a shell (curl/wget … | sh)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*ADD\s+https?:\/\//i,
+        label: 'ADD from a URL (prefer COPY, or verify a checksum)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*(?:ENV|ARG)\s+\w*(?:PASSWORD|SECRET|TOKEN|API_?KEY|ACCESS_KEY)\w*\s*[=\s]/i,
+        label: 'secret baked into ENV/ARG (use build secrets / runtime injection)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(?:--no-check-certificate|--insecure)\b/,
+        label: 'insecure download flag (--insecure / --no-check-certificate)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*RUN\s+.*\bsudo\b/,
+        label: 'sudo inside RUN (unnecessary and risky in a container build)',
+        severity: 'warn',
+    },
+];
+function scanDiff(stdout) {
+    const errors = {};
+    const warnings = {};
+    for (const line of stdout.split('\n')) {
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        for (const { pattern, label, severity } of DOCKER_PATTERNS) {
+            if (pattern.test(line)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+    return { errors, warnings };
+}
+exports.dockerfileSecurityCheck = {
+    name: 'Dockerfile Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.dockerfileSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        const dockerfiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, DOCKERFILE_GLOBS));
+        if (dockerfiles.length === 0)
+            return (0, types_1.pass)();
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd });
+            const { errors, warnings } = scanDiff(stdout);
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Dockerfile Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+                ignore: ctx.config.dockerfileSecurity?.ignore,
+            });
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/security/migration-safety.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const migrationSafetyCheck: Check;