pr-checkmate 1.22.7 → 1.23.0

package/dist/core/checks/security/migration-safety.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationSafetyCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Paths treated as database migrations. A client overrides via
+ * `migrationSafety.paths` (REPLACES this list).
+ */
+const DEFAULT_MIGRATION_GLOBS = [
+    '**/migrations/**',
+    '**/migrate/**',
+    '**/db/migrate/**', // Rails
+    '**/versions/**', // Alembic
+    '**/*.sql',
+];
+/** Destructive / locking operations, matched on added diff lines. */
+const DDL_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bDROP\s+TABLE\b/i, label: 'DROP TABLE — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bDROP\s+COLUMN\b/i, label: 'DROP COLUMN — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bTRUNCATE\b/i, label: 'TRUNCATE — irreversible data loss' },
+    {
+        pattern: /^\+(?!\+).*\bRENAME\s+(?:COLUMN|TABLE)\b/i,
+        label: 'RENAME — breaks code still reading the old name',
+    },
+    { pattern: /^\+(?!\+).*\bDROP\s+(?:CONSTRAINT|INDEX)\b/i, label: 'DROP CONSTRAINT/INDEX' },
+    {
+        pattern: /^\+(?!\+).*\bALTER\s+COLUMN\b.*\bSET\s+NOT\s+NULL\b/i,
+        label: 'SET NOT NULL — locks the table, rejects existing NULL rows',
+    },
+    // Alembic (Python) operations.
+    { pattern: /^\+(?!\+).*\bop\.drop_column\b/, label: 'op.drop_column — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bop\.drop_table\b/, label: 'op.drop_table — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bop\.drop_constraint\b/, label: 'op.drop_constraint' },
+];
+const NOT_NULL_NO_DEFAULT = 'ADD COLUMN … NOT NULL without DEFAULT — fails/locks on a non-empty table';
+/**
+ * A new NOT NULL column with no DEFAULT: the classic migration that breaks on a
+ * populated table. Split out because it's a conjunction (ADD COLUMN + NOT NULL,
+ * and NO DEFAULT on the line), not a single keyword.
+ */
+function isAddNotNullNoDefault(line) {
+    return (/^\+(?!\+)/.test(line) &&
+        /\bADD\s+COLUMN\b/i.test(line) &&
+        /\bNOT\s+NULL\b/i.test(line) &&
+        !/\bDEFAULT\b/i.test(line));
+}
+/** Bucket dangerous added lines by risk label, honouring the opt-out directive. */
+function scan(stdout, findings) {
+    for (const line of stdout.split('\n')) {
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        for (const { pattern, label } of DDL_PATTERNS) {
+            if (pattern.test(line))
+                (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 120));
+        }
+        if (isAddNotNullNoDefault(line)) {
+            (findings[NOT_NULL_NO_DEFAULT] ?? (findings[NOT_NULL_NO_DEFAULT] = [])).push(line.slice(1).trim().substring(0, 120));
+        }
+    }
+}
+exports.migrationSafetyCheck = {
+    name: 'Migration Safety',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.migrationSafety?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        // Not sourcePath-scoped: migrations commonly live outside `src` (db/, alembic/).
+        // ignoreDirs still applies via resolveTargetFiles.
+        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        const globs = ctx.config.migrationSafety?.paths ?? DEFAULT_MIGRATION_GLOBS;
+        const migrationFiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, globs));
+        if (migrationFiles.length === 0)
+            return (0, types_1.pass)();
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--unified=0',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+                '--',
+                ...migrationFiles,
+            ], { cwd: ctx.cwd });
+            const findings = {};
+            scan(stdout, findings);
+            if ((0, findings_1.bucketTotal)(findings) === 0)
+                return (0, types_1.pass)();
+            const sev = (0, findings_1.severityEmitter)(ctx.config.migrationSafety?.severity, 'warn');
+            (0, findings_1.logFindings)(findings, {
+                prefix: 'Migration Safety',
+                sampleLimit: 2,
+                isError: sev.icon === '❌',
+            });
+            const summary = Object.entries(findings)
+                .map(([label, arr]) => `${arr.length}× ${label.split(' — ')[0]}`)
+                .join(', ');
+            return sev.emit(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{security.d.ts → security/security.d.ts}

@@ -1,4 +1,4 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 /**
  * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on
  * every repo (Node, Python, C++, mobile). Secrets found → fail (blocking).

package/dist/core/checks/{security.js → security/security.js}

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.securityCheck = void 0;
-const config_1 = require("../../config");
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 /**
  * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on
  * every repo (Node, Python, C++, mobile). Secrets found → fail (blocking).

package/dist/core/checks/{sensitive-file-guard.d.ts → security/sensitive-file-guard.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const sensitiveFileGuardCheck: Check;

package/dist/core/checks/{sensitive-file-guard.js → security/sensitive-file-guard.js}

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sensitiveFileGuardCheck = void 0;
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
 const SENSITIVE_CATEGORIES = [
     {
         label: 'Environment files (.env)',

package/dist/core/checks/security/workflow-security.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const workflowSecurityCheck: Check;

package/dist/core/checks/security/workflow-security.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workflowSecurityCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * GitHub Actions workflow risks, matched on added diff lines of workflow files.
+ * These are the high-frequency supply-chain / injection footguns.
+ */
+const WORKFLOW_PATTERNS = [
+    {
+        // Untrusted PR-controlled input interpolated into an expression — the classic
+        // `run:` script-injection vector when it reaches a shell.
+        pattern: /^\+(?!\+).*\$\{\{\s*github\.event\.(?:issue|pull_request|comment|review|discussion|head_commit|commits)[^}]*\.(?:title|body|head_ref|ref|label|name|email|message|url)/,
+        label: 'untrusted github.event input in expression (script injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\$\{\{\s*github\.head_ref\s*\}\}/,
+        label: 'github.head_ref interpolation (injection risk — use an env var)',
+        severity: 'warn',
+    },
+    {
+        // Third-party action not pinned to a full 40-char commit SHA.
+        pattern: /^\+(?!\+).*\buses:\s*['"]?[\w.-]+\/[\w.-]+@(?![0-9a-fA-F]{40}\b)[\w./-]+/,
+        label: 'action not pinned to a full commit SHA (supply-chain risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bpull_request_target\b/,
+        label: 'pull_request_target trigger (runs with repo secrets on untrusted PRs)',
+        severity: 'warn',
+    },
+];
+function scanDiff(stdout) {
+    const errors = {};
+    const warnings = {};
+    for (const line of stdout.split('\n')) {
+        for (const { pattern, label, severity } of WORKFLOW_PATTERNS) {
+            if (pattern.test(line)) {
+                const bucket = severity === 'error' ? errors : warnings;
+                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            }
+        }
+    }
+    return { errors, warnings };
+}
+exports.workflowSecurityCheck = {
+    name: 'Workflow Security',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.workflowSecurity?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            const stdout = await (0, findings_1.diffAddedLines)(ctx, [
+                '.github/workflows/*.yml',
+                '.github/workflows/*.yaml',
+            ]);
+            const { errors, warnings } = scanDiff(stdout);
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: 'Workflow Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                sampleLimit: 3,
+                ignore: ctx.config.workflowSecurity?.ignore,
+            });
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Workflow Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/context.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildContext = buildContext;
+const node_fs_1 = __importDefault(require("node:fs"));
 const loader_1 = require("../config/loader");
 const utils_1 = require("../utils");
 const detect_language_1 = require("../utils/detect-language");
@@ -10,7 +14,35 @@ const execa_1 = require("../utils/execa");
  * Prefers explicit opts, then GitHub PR event, then Bitbucket PR env, then git HEAD^.
  * Returns undefined SHAs when nothing usable is found → checks fall back to full scan.
  */
+/**
+ * Resolve a git ref to a concrete commit SHA, or undefined when it can't be
+ * resolved in this clone. `--verify --quiet` emits nothing (instead of echoing
+ * the literal ref) and exits non-zero for a missing ref — e.g. `HEAD^` on a
+ * single-commit repo, or a base branch not fetched in a shallow CI clone. That
+ * way an unresolvable base yields `undefined` and callers fall back to a full
+ * scan, rather than diffing against a garbage ref and silently checking nothing.
+ */
+async function resolveRef(cwd, ref) {
+    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
+        cwd,
+        reject: false,
+    });
+    return stdout.trim() || undefined;
+}
 async function resolveDiffRange(cwd, opts) {
+    // Pre-commit mode: diff HEAD against the current index. `git write-tree`
+    // materialises the staged index as a real tree object, so every check that
+    // diffs baseSha..headSha sees exactly the staged changes — no per-check code.
+    if (opts.staged) {
+        try {
+            const head = (await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
+            const tree = (await (0, execa_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
+            return { baseSha: head, headSha: tree };
+        }
+        catch {
+            return {};
+        }
+    }
     if (opts.baseSha || opts.headSha) {
         return { baseSha: opts.baseSha, headSha: opts.headSha };
     }
@@ -22,17 +54,28 @@ async function resolveDiffRange(cwd, opts) {
     catch {
         return {};
     }
-    // Bitbucket exposes the PR destination branch; GitHub delta is handled by utils/delta.
-    const bitbucketTarget = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
-    try {
-        const ref = bitbucketTarget ? `origin/${bitbucketTarget}` : 'HEAD^';
-        const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', ref], { cwd, reject: false });
-        const baseSha = stdout.trim();
-        return { baseSha: baseSha || undefined, headSha };
-    }
-    catch {
-        return { headSha };
+    // GitHub Actions: the PR event payload carries the base branch SHA. Read it
+    // directly so delta works without relying on any client-set variable
+    // (GITHUB_EVENT_* are injected by the runner).
+    if (process.env.GITHUB_EVENT_NAME === 'pull_request' && process.env.GITHUB_EVENT_PATH) {
+        try {
+            const event = JSON.parse(node_fs_1.default.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf-8'));
+            const eventBase = event?.pull_request?.base?.sha;
+            // Only use it if the commit is actually present in this clone; otherwise
+            // fall through so a shallow clone degrades to a full scan, not 0 files.
+            const baseSha = eventBase ? await resolveRef(cwd, eventBase) : undefined;
+            if (baseSha)
+                return { baseSha, headSha };
+        }
+        catch {
+            // Malformed/unreadable event — fall through to the git-based resolution.
+        }
     }
+    // Bitbucket exposes the PR destination branch as an env var (also runner-set).
+    const bitbucketTarget = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
+    const ref = bitbucketTarget ? `origin/${bitbucketTarget}` : 'HEAD^';
+    const baseSha = await resolveRef(cwd, ref);
+    return { baseSha, headSha };
 }
 /**
  * Assemble the shared CheckContext once per run. Language detection is skipped
@@ -51,5 +94,6 @@ async function buildContext(opts = {}) {
         write: opts.write ?? false,
         baseSha,
         headSha,
+        cache: new Map(),
     };
 }

package/dist/core/registry.js

@@ -1,40 +1,62 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REGISTRY = void 0;
-// blocking — a failure here makes the whole run fail (report.ok === false)
-const circular_deps_1 = require("./checks/circular-deps");
-const commitlint_1 = require("./checks/commitlint");
-const cpp_format_1 = require("./checks/cpp-format");
-const dead_code_1 = require("./checks/dead-code");
-const dependency_check_1 = require("./checks/dependency-check");
-const diff_security_1 = require("./checks/diff-security");
-const diff_smell_1 = require("./checks/diff-smell");
-const duplicate_check_1 = require("./checks/duplicate-check");
-const kotlin_lint_1 = require("./checks/kotlin-lint");
-const license_check_1 = require("./checks/license-check");
-const lint_1 = require("./checks/lint");
-const markdown_lint_1 = require("./checks/markdown-lint");
-const npm_audit_1 = require("./checks/npm-audit");
-// informational — warn/skip only, never fail the run
-const outdated_deps_1 = require("./checks/outdated-deps");
-const pr_body_1 = require("./checks/pr-body");
-const pr_size_check_1 = require("./checks/pr-size-check");
-const pr_title_lint_1 = require("./checks/pr-title-lint");
-const prettier_1 = require("./checks/prettier");
-const python_format_1 = require("./checks/python-format");
-const python_lint_1 = require("./checks/python-lint");
-const security_1 = require("./checks/security");
-const sensitive_file_guard_1 = require("./checks/sensitive-file-guard");
-const spellcheck_1 = require("./checks/spellcheck");
-const swift_lint_1 = require("./checks/swift-lint");
-// format — runs last, may write files
-const typecheck_1 = require("./checks/typecheck");
+const banned_imports_1 = require("./checks/dependencies/banned-imports");
+const circular_deps_1 = require("./checks/dependencies/circular-deps");
+const dependency_check_1 = require("./checks/dependencies/dependency-check");
+const license_check_1 = require("./checks/dependencies/license-check");
+const npm_audit_1 = require("./checks/dependencies/npm-audit");
+const outdated_deps_1 = require("./checks/dependencies/outdated-deps");
+const vuln_scan_1 = require("./checks/dependencies/vuln-scan");
+const custom_rules_1 = require("./checks/git/custom-rules");
+const diff_smell_1 = require("./checks/git/diff-smell");
+const large_files_1 = require("./checks/git/large-files");
+const leftover_debug_1 = require("./checks/git/leftover-debug");
+const lockfile_drift_1 = require("./checks/git/lockfile-drift");
+const merge_conflict_1 = require("./checks/git/merge-conflict");
+const missing_tests_1 = require("./checks/git/missing-tests");
+const todo_fixme_1 = require("./checks/git/todo-fixme");
+const cpp_format_1 = require("./checks/languages/cpp-format");
+const csharp_format_1 = require("./checks/languages/csharp-format");
+const go_format_1 = require("./checks/languages/go-format");
+const go_lint_1 = require("./checks/languages/go-lint");
+const kotlin_lint_1 = require("./checks/languages/kotlin-lint");
+const lint_1 = require("./checks/languages/lint");
+const php_format_1 = require("./checks/languages/php-format");
+const prettier_1 = require("./checks/languages/prettier");
+const python_format_1 = require("./checks/languages/python-format");
+const python_lint_1 = require("./checks/languages/python-lint");
+const python_typecheck_1 = require("./checks/languages/python-typecheck");
+const ruby_lint_1 = require("./checks/languages/ruby-lint");
+const rust_format_1 = require("./checks/languages/rust-format");
+const rust_lint_1 = require("./checks/languages/rust-lint");
+const swift_lint_1 = require("./checks/languages/swift-lint");
+const typecheck_1 = require("./checks/languages/typecheck");
+const commitlint_1 = require("./checks/pr/commitlint");
+const pr_body_1 = require("./checks/pr/pr-body");
+const pr_size_check_1 = require("./checks/pr/pr-size-check");
+const pr_title_lint_1 = require("./checks/pr/pr-title-lint");
+const case_collision_1 = require("./checks/quality/case-collision");
+const config_validation_1 = require("./checks/quality/config-validation");
+const coverage_1 = require("./checks/quality/coverage");
+const dead_code_1 = require("./checks/quality/dead-code");
+const duplicate_check_1 = require("./checks/quality/duplicate-check");
+const license_header_1 = require("./checks/quality/license-header");
+const markdown_lint_1 = require("./checks/quality/markdown-lint");
+const spellcheck_1 = require("./checks/quality/spellcheck");
+const diff_security_1 = require("./checks/security/diff-security");
+const dockerfile_security_1 = require("./checks/security/dockerfile-security");
+const migration_safety_1 = require("./checks/security/migration-safety");
+const security_1 = require("./checks/security/security");
+const sensitive_file_guard_1 = require("./checks/security/sensitive-file-guard");
+const workflow_security_1 = require("./checks/security/workflow-security");
 /**
  * Every check, in declaration order. The orchestrator groups them by `phase`
  * (blocking → informational → format) and runs each phase's checks in parallel.
  */
 exports.REGISTRY = [
     // blocking
+    merge_conflict_1.mergeConflictCheck,
     security_1.securityCheck,
     typecheck_1.typecheckCheck,
     lint_1.lintCheck,
@@ -45,6 +67,21 @@ exports.REGISTRY = [
     // informational
     diff_smell_1.diffSmellCheck,
     diff_security_1.diffSecurityCheck,
+    workflow_security_1.workflowSecurityCheck,
+    dockerfile_security_1.dockerfileSecurityCheck,
+    case_collision_1.caseCollisionCheck,
+    vuln_scan_1.vulnScanCheck,
+    custom_rules_1.customRulesCheck,
+    banned_imports_1.bannedImportsCheck,
+    license_header_1.licenseHeaderCheck,
+    config_validation_1.configValidationCheck,
+    leftover_debug_1.leftoverDebugCheck,
+    lockfile_drift_1.lockfileDriftCheck,
+    large_files_1.largeFilesCheck,
+    todo_fixme_1.todoFixmeCheck,
+    missing_tests_1.missingTestsCheck,
+    coverage_1.coverageCheck,
+    migration_safety_1.migrationSafetyCheck,
     sensitive_file_guard_1.sensitiveFileGuardCheck,
     pr_body_1.prBodyCheck,
     duplicate_check_1.duplicateCheck,
@@ -55,11 +92,19 @@ exports.REGISTRY = [
     markdown_lint_1.markdownLintCheck,
     spellcheck_1.spellcheckCheck,
     python_lint_1.pythonLintCheck,
+    python_typecheck_1.pythonTypecheckCheck,
     dead_code_1.deadCodeCheck,
     swift_lint_1.swiftLintCheck,
     kotlin_lint_1.kotlinLintCheck,
+    go_lint_1.goLintCheck,
+    rust_lint_1.rustLintCheck,
+    ruby_lint_1.rubyLintCheck,
     // format
     prettier_1.prettierCheck,
     cpp_format_1.cppFormatCheck,
     python_format_1.pythonFormatCheck,
+    go_format_1.goFormatCheck,
+    rust_format_1.rustFormatCheck,
+    csharp_format_1.csharpFormatCheck,
+    php_format_1.phpFormatCheck,
 ];

package/dist/core/reporters.d.ts

@@ -1,6 +1,7 @@
-import type { CheckReport } from './types';
+import type { CheckReport, ReporterKind } from './types';
 /**
  * Emit the report through the selected channel.
- * none: nothing · stdout: console table · github: table + upsert PR comment.
+ * none: nothing · stdout: console table · github/gitlab/bitbucket: table +
+ * upsert the PR/MR comment · auto: detect the platform from the environment.
  */
-export declare function report(kind: 'none' | 'stdout' | 'github', result: CheckReport): Promise<void>;
+export declare function report(kind: ReporterKind, result: CheckReport): Promise<void>;

package/dist/core/reporters.js

@@ -110,15 +110,115 @@ async function upsertGithubComment(body) {
         utils_1.logger.warn(`[reporter]: ⚠️ Could not post GitHub comment: ${err}`);
     }
 }
+/**
+ * Upsert a GitLab MR note (find our marker → update, else create). Uses the
+ * standard CI variables plus a `GITLAB_TOKEN` with `api` scope. Skips gracefully
+ * when not in an MR pipeline or the token is missing.
+ */
+async function upsertGitlabNote(body) {
+    const base = process.env.CI_API_V4_URL;
+    const project = process.env.CI_PROJECT_ID;
+    const iid = process.env.CI_MERGE_REQUEST_IID;
+    const token = process.env.GITLAB_TOKEN;
+    if (!base || !project || !iid || !token) {
+        utils_1.logger.info('[reporter]: Skipping GitLab note (not an MR pipeline or GITLAB_TOKEN missing)');
+        return;
+    }
+    const notes = `${base}/projects/${project}/merge_requests/${iid}/notes`;
+    const headers = { 'PRIVATE-TOKEN': token, 'Content-Type': 'application/json' };
+    try {
+        const listRes = await fetch(notes, { headers });
+        if (listRes.ok) {
+            const existing = (await listRes.json()).find(n => typeof n.body === 'string' && n.body.includes(COMMENT_MARKER));
+            if (existing) {
+                await fetch(`${notes}/${existing.id}`, {
+                    method: 'PUT',
+                    headers,
+                    body: JSON.stringify({ body }),
+                });
+                utils_1.logger.info('[reporter]: ✅ Updated PR CheckMate note on GitLab MR');
+                return;
+            }
+        }
+        await fetch(notes, { method: 'POST', headers, body: JSON.stringify({ body }) });
+        utils_1.logger.info('[reporter]: ✅ Posted PR CheckMate summary to GitLab MR');
+    }
+    catch (err) {
+        utils_1.logger.warn(`[reporter]: ⚠️ Could not post GitLab note: ${err}`);
+    }
+}
+/**
+ * Upsert a Bitbucket PR comment (find our marker → update, else create). Uses
+ * Bitbucket Pipelines variables plus a `BITBUCKET_TOKEN` (repo/PR write). Skips
+ * gracefully when not in a PR pipeline or the token is missing.
+ */
+async function upsertBitbucketComment(body) {
+    const fullName = process.env.BITBUCKET_REPO_FULL_NAME;
+    const prId = process.env.BITBUCKET_PR_ID;
+    const token = process.env.BITBUCKET_TOKEN;
+    if (!fullName || !prId || !token) {
+        utils_1.logger.info('[reporter]: Skipping Bitbucket comment (not a PR pipeline or BITBUCKET_TOKEN missing)');
+        return;
+    }
+    const commentsUrl = `https://api.bitbucket.org/2.0/repositories/${fullName}/pullrequests/${prId}/comments`;
+    const headers = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' };
+    try {
+        const listRes = await fetch(`${commentsUrl}?pagelen=100`, { headers });
+        if (listRes.ok) {
+            const values = (await listRes.json()).values;
+            const existing = values?.find(c => c.content?.raw?.includes(COMMENT_MARKER));
+            if (existing) {
+                await fetch(`${commentsUrl}/${existing.id}`, {
+                    method: 'PUT',
+                    headers,
+                    body: JSON.stringify({ content: { raw: body } }),
+                });
+                utils_1.logger.info('[reporter]: ✅ Updated PR CheckMate comment on Bitbucket PR');
+                return;
+            }
+        }
+        await fetch(commentsUrl, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ content: { raw: body } }),
+        });
+        utils_1.logger.info('[reporter]: ✅ Posted PR CheckMate summary to Bitbucket PR');
+    }
+    catch (err) {
+        utils_1.logger.warn(`[reporter]: ⚠️ Could not post Bitbucket comment: ${err}`);
+    }
+}
+/** Detect the CI platform from the environment, or null when unknown/local. */
+function detectPlatform() {
+    if (process.env.GITHUB_ACTIONS || process.env.GITHUB_EVENT_NAME)
+        return 'github';
+    if (process.env.GITLAB_CI)
+        return 'gitlab';
+    if (process.env.BITBUCKET_PIPELINE_UUID || process.env.BITBUCKET_PR_ID)
+        return 'bitbucket';
+    return null;
+}
+/** Post the markdown report to a specific platform's PR/MR. */
+async function postToPlatform(platform, result) {
+    const body = buildMarkdownReport(result);
+    if (platform === 'github')
+        return upsertGithubComment(body);
+    if (platform === 'gitlab')
+        return upsertGitlabNote(body);
+    return upsertBitbucketComment(body);
+}
 /**
  * Emit the report through the selected channel.
- * none: nothing · stdout: console table · github: table + upsert PR comment.
+ * none: nothing · stdout: console table · github/gitlab/bitbucket: table +
+ * upsert the PR/MR comment · auto: detect the platform from the environment.
  */
 async function report(kind, result) {
     if (kind === 'none')
         return;
     printStdout(result);
-    if (kind === 'github' && result.results.length > 0) {
-        await upsertGithubComment(buildMarkdownReport(result));
-    }
+    if (result.results.length === 0)
+        return;
+    const platform = kind === 'auto' ? detectPlatform() : kind === 'stdout' ? null : kind;
+    if (platform)
+        await postToPlatform(platform, result);
 }

package/dist/core/run-checks.js

@@ -50,6 +50,20 @@ function selectChecks(checks, opts) {
 function errMessage(err) {
     return err instanceof Error ? err.message.split('\n')[0].slice(0, 160) : String(err);
 }
+/**
+ * Apply the universal `config.severity` override for a check. Only remaps
+ * between warn↔fail (pass/skip are never changed); `off` is handled earlier by
+ * excluding the check from the run entirely. This is what lets a repo turn any
+ * advisory check into a gate, or downgrade a blocking one, by name.
+ */
+function applySeverity(name, status, ctx) {
+    const sev = ctx.config.severity?.[name];
+    if (sev === 'error' && status === 'warn')
+        return 'fail';
+    if (sev === 'warn' && status === 'fail')
+        return 'warn';
+    return status;
+}
 /** Run one check: gate on `applies`, execute, translate throws into `fail`. */
 async function runOne(check, ctx, collector) {
     try {
@@ -63,12 +77,13 @@ async function runOne(check, ctx, collector) {
             return;
         }
         const outcome = await check.run(ctx);
-        collector.register(check.name, outcome.status, outcome.details);
+        collector.register(check.name, applySeverity(check.name, outcome.status, ctx), outcome.details);
     }
     catch (err) {
         // An unexpected throw in a blocking check fails the run; in informational/format
         // phases it only warns — those phases never block, matching the legacy pipeline.
-        const status = check.phase === 'blocking' ? 'fail' : 'warn';
+        const base = check.phase === 'blocking' ? 'fail' : 'warn';
+        const status = applySeverity(check.name, base, ctx);
         utils_1.logger.error(`[runChecks]: ${status === 'fail' ? '❌' : '⚠️'} ${check.name} threw: ${err}`);
         collector.register(check.name, status, errMessage(err));
     }
@@ -82,7 +97,10 @@ async function runOne(check, ctx, collector) {
  */
 async function runChecks(opts = {}) {
     const ctx = await (0, context_1.buildContext)(opts);
-    const selected = selectChecks(resolveChecks(opts), opts);
+    // `severity: { "<name>": "off" }` disables any check by name, universally —
+    // a superset of the per-check `enabled: false` flags.
+    const off = ctx.config.severity ?? {};
+    const selected = selectChecks(resolveChecks(opts), opts).filter(c => off[c.name] !== 'off');
     const collector = new result_collector_1.ResultCollector();
     for (const phase of types_1.PHASES) {
         const inPhase = selected.filter(c => c.phase === phase);