pr-checkmate 1.22.8 → 1.23.0

package/dist/core/checks/git/leftover-debug.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.leftoverDebugCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Debug statements for languages NOT already covered by the Diff Smells check
+ * (which handles `console.*`/`debugger` for JS/TS). Kept separate so the two
+ * checks never double-report the same finding in a PR comment.
+ */
+const PYTHON_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bprint\s*\(/, label: 'print()' },
+    { pattern: /^\+(?!\+).*\bpprint\s*\(/, label: 'pprint()' },
+    { pattern: /^\+(?!\+).*\bbreakpoint\s*\(/, label: 'breakpoint()' },
+    { pattern: /^\+(?!\+).*\bpdb\.set_trace\s*\(/, label: 'pdb.set_trace()' },
+];
+const KOTLIN_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bSystem\.(out|err)\.println\s*\(/, label: 'System.out/err.println()' },
+    // Bare println(...), but not the qualified System.out.println above — the
+    // negative lookbehind rejects a preceding `.` or identifier char.
+    { pattern: /^\+(?!\+).*(?<![.\w])println\s*\(/, label: 'println()' },
+];
+/** Bucket added-line matches by label, skipping lines opted out via directive. */
+function collect(stdout, patterns, findings) {
+    for (const line of stdout.split('\n')) {
+        // Honour an inline opt-out in any comment style (`// pr-checkmate-ignore`,
+        // `# pr-checkmate-ignore`).
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        // Match on the comment-stripped line so `# print(x)` in a comment isn't flagged.
+        const scanned = (0, findings_1.stripInlineComment)(line);
+        for (const { pattern, label } of patterns) {
+            if (pattern.test(scanned)) {
+                (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 100));
+            }
+        }
+    }
+}
+exports.leftoverDebugCheck = {
+    name: 'Leftover Debug',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.leftoverDebug?.enabled !== false &&
+            Boolean(ctx.baseSha) &&
+            (ctx.languages.includes('python') || ctx.languages.includes('kotlin')));
+    },
+    async run(ctx) {
+        try {
+            const findings = {};
+            if (ctx.languages.includes('python')) {
+                collect(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), PYTHON_PATTERNS, findings);
+            }
+            if (ctx.languages.includes('kotlin')) {
+                collect(await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']), KOTLIN_PATTERNS, findings);
+            }
+            if ((0, findings_1.bucketTotal)(findings) === 0)
+                return (0, types_1.pass)();
+            // Advisory by default; a repo may promote to a gate via
+            // `leftoverDebug.severity: 'error'`.
+            const sev = (0, findings_1.severityEmitter)(ctx.config.leftoverDebug?.severity, 'warn');
+            (0, findings_1.logFindings)(findings, {
+                prefix: 'Leftover Debug',
+                sampleLimit: 3,
+                isError: sev.icon === '❌',
+            });
+            const summary = Object.entries(findings)
+                .map(([label, arr]) => `${arr.length}× ${label}`)
+                .join(', ');
+            return sev.emit(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Leftover Debug]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/git/lockfile-drift.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const lockfileDriftCheck: Check;

package/dist/core/checks/git/lockfile-drift.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockfileDriftCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Manifest → its lockfile(s). A change to the manifest's dependency set without
+ * a corresponding lockfile update is drift: CI resolves versions the author
+ * never locked. Matched by basename so monorepo sub-packages work too.
+ */
+const LOCK_PAIRS = [
+    { manifest: 'package.json', locks: ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'] },
+    { manifest: 'pyproject.toml', locks: ['poetry.lock', 'uv.lock'] },
+    { manifest: 'requirements.in', locks: ['requirements.txt'] },
+    { manifest: 'go.mod', locks: ['go.sum'] },
+    { manifest: 'Cargo.toml', locks: ['Cargo.lock'] },
+    { manifest: 'Gemfile', locks: ['Gemfile.lock'] },
+];
+const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+/** Extract only the dependency sections of a parsed package.json, or `{}`. */
+function extractDeps(raw) {
+    try {
+        const json = JSON.parse(raw);
+        const deps = {};
+        for (const key of DEP_KEYS)
+            if (json[key])
+                deps[key] = json[key];
+        return deps;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * True when a package.json's dependency sections differ between base and head.
+ * Guards against false positives from `version`/`scripts`-only edits that don't
+ * need a lockfile refresh. A newly added manifest (no base version) counts as
+ * changed. Other ecosystems have no zero-dependency parser here, so they trigger
+ * on any manifest change.
+ */
+async function packageDepsChanged(ctx, manifestPath, base) {
+    let headDeps = {};
+    try {
+        headDeps = extractDeps(node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, manifestPath), 'utf-8'));
+    }
+    catch {
+        // Head file unreadable (e.g. deleted) — treat as changed so it surfaces.
+        return true;
+    }
+    const { stdout, exitCode } = await (0, execa_1.execa)('git', ['show', `${base}:${manifestPath}`], {
+        cwd: ctx.cwd,
+        reject: false,
+    });
+    const baseDeps = exitCode === 0 ? extractDeps(stdout) : {};
+    return JSON.stringify(headDeps) !== JSON.stringify(baseDeps);
+}
+exports.lockfileDriftCheck = {
+    name: 'Lockfile Drift',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.lockfileDrift?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        try {
+            // Raw name-only diff — manifests/locks live at the repo root, outside any
+            // configured `sourcePath`, so this deliberately does NOT scope (same as
+            // the Sensitive Files guard). Scoping would hide the very files we check.
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--name-only',
+                '--diff-filter=ACMRD',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+            ], { cwd: ctx.cwd });
+            const changed = new Set(stdout.split('\n').filter(Boolean));
+            const warnings = [];
+            for (const changedPath of changed) {
+                const pair = LOCK_PAIRS.find(p => p.manifest === node_path_1.default.basename(changedPath));
+                if (!pair)
+                    continue;
+                // For package.json, only flag when the dependency set actually changed.
+                if (pair.manifest === 'package.json') {
+                    if (!(await packageDepsChanged(ctx, changedPath, ctx.baseSha)))
+                        continue;
+                }
+                const dir = node_path_1.default.dirname(changedPath);
+                const lockPath = (lock) => (dir === '.' ? lock : `${dir}/${lock}`);
+                const presentLocks = pair.locks.filter(lock => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, lockPath(lock))));
+                if (presentLocks.length === 0)
+                    continue; // no lockfile committed → nothing to drift
+                const anyLockChanged = presentLocks.some(lock => changed.has(lockPath(lock)));
+                if (!anyLockChanged) {
+                    warnings.push(`${changedPath} changed but ${presentLocks.join(' / ')} not updated`);
+                }
+            }
+            if (warnings.length === 0)
+                return (0, types_1.pass)();
+            const sev = (0, findings_1.severityEmitter)(ctx.config.lockfileDrift?.severity, 'warn');
+            warnings.forEach(w => sev.log(`[Lockfile Drift]: ${sev.icon} ${w}`));
+            return sev.emit(`${warnings.length} manifest(s) changed without a lockfile update`);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Lockfile Drift]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/git/merge-conflict.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const mergeConflictCheck: Check;

package/dist/core/checks/git/merge-conflict.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeConflictCheck = void 0;
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * Git conflict markers, matched against the content of an added diff line
+ * (the leading `+` already stripped). Each is exactly seven characters at the
+ * start of the line, optionally followed by a space + branch/ref label
+ * (`=======` stands alone). `|||||||` is the diff3 base-section marker.
+ */
+const MARKER_START = /^<{7}(?: |$)/;
+const MARKER_BASE = /^\|{7}(?: |$)/;
+const MARKER_SEP = /^={7}$/;
+const MARKER_END = /^>{7}(?: |$)/;
+/** An angle marker (`<<<<<<<` / `>>>>>>>`) is unambiguous on its own. */
+function isAngleMarker(content) {
+    return MARKER_START.test(content) || MARKER_END.test(content);
+}
+/**
+ * Parse a `git diff --unified=0` and return every added line that looks like a
+ * conflict marker, tracking the file and new-file line number for reporting.
+ */
+function scanDiff(diff) {
+    const hits = [];
+    let file = '';
+    let newLine = 0;
+    for (const raw of diff.split('\n')) {
+        if (raw.startsWith('+++ ')) {
+            // `+++ b/path` (or `+++ /dev/null` for deletions). Strip the `b/` prefix.
+            const path = raw.slice(4).trim();
+            file = path === '/dev/null' ? '' : path.replace(/^b\//, '');
+            continue;
+        }
+        if (raw.startsWith('---'))
+            continue; // old-file header, never a content line
+        if (raw.startsWith('@@')) {
+            // @@ -oldStart,oldLen +newStart,newLen @@ — reset the new-file counter.
+            const m = /\+(\d+)/.exec(raw);
+            newLine = m ? Number(m[1]) : 0;
+            continue;
+        }
+        if (raw.startsWith('+')) {
+            const content = raw.slice(1);
+            if (file &&
+                (isAngleMarker(content) || MARKER_BASE.test(content) || MARKER_SEP.test(content))) {
+                hits.push({ file, line: newLine, angle: isAngleMarker(content) });
+            }
+            newLine += 1;
+        }
+        // Removed (`-`) lines don't advance the new-file counter; with --unified=0
+        // there are no context lines to account for.
+    }
+    return hits;
+}
+/**
+ * Keep every angle/base marker, but a bare `=======` only counts when the same
+ * file also carries an angle marker. A standalone `=======` is a legitimate
+ * markdown setext-heading underline; requiring a bracketing `<<<<<<<`/`>>>>>>>`
+ * in the file avoids that false positive while still catching real conflicts.
+ */
+function filterHits(hits) {
+    const filesWithAngle = new Set(hits.filter(h => h.angle).map(h => h.file));
+    return hits.filter(h => h.angle || filesWithAngle.has(h.file));
+}
+exports.mergeConflictCheck = {
+    name: 'Merge Conflict',
+    phase: 'blocking',
+    applies(ctx) {
+        return ctx.config.mergeConflict?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        // Resolve the scoped file set the canonical way (delta-aware, honouring the
+        // client's `ignoreDirs` and `sourcePath`), then diff only those files for
+        // content. `['*']` matches every path since conflicts are language-agnostic;
+        // scoping still keeps build/vendor/report dirs out, like every other check.
+        const files = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
+        if (files === null)
+            return (0, types_1.skip)('git unavailable');
+        if (files.length === 0)
+            return (0, types_1.pass)();
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...files], { cwd: ctx.cwd });
+            const hits = filterHits(scanDiff(stdout));
+            if (hits.length === 0)
+                return (0, types_1.pass)();
+            // Conflict markers are a hard error by default; a repo may downgrade to
+            // `warn` via `mergeConflict.severity`.
+            const sev = (0, findings_1.severityEmitter)(ctx.config.mergeConflict?.severity, 'error');
+            for (const h of hits) {
+                sev.log(`[Merge Conflict]: ${sev.icon} ${h.file}:${h.line}`);
+            }
+            const sample = hits
+                .slice(0, 5)
+                .map(h => `${h.file}:${h.line}`)
+                .join(', ');
+            const more = hits.length > 5 ? ` (+${hits.length - 5} more)` : '';
+            return sev.emit(`${hits.length} unresolved conflict marker(s): ${sample}${more}`);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Merge Conflict]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/git/missing-tests.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const missingTestsCheck: Check;

package/dist/core/checks/git/missing-tests.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.missingTestsCheck = void 0;
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/** Source-file extensions across the supported languages. */
+const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|kt|kts|java|swift|cpp|cc|cxx|c|h|hpp|go|rb)$/i;
+/** Test-file conventions across languages. */
+function isTestFile(file) {
+    return (/\.(test|spec)\.[cm]?[jt]sx?$/i.test(file) || // foo.test.ts, foo.spec.jsx
+        /(^|\/)__tests__\//.test(file) ||
+        /(^|\/)tests?\//i.test(file) || // test/ or tests/ dir
+        /(^|\/)test_[^/]+\.py$/.test(file) || // test_foo.py
+        /_test\.(py|go)$/.test(file) || // foo_test.py, foo_test.go
+        /(Test|Spec)s?\.(kt|java|swift)$/.test(file) // FooTest.kt, FooSpec.swift
+    );
+}
+/**
+ * Source files that legitimately ship without a test of their own. Setting
+ * `missingTests.ignore` REPLACES this list (same convention as duplicate/
+ * dead-code ignores).
+ */
+const DEFAULT_IGNORE = [
+    '**/*.d.ts',
+    '**/index.ts',
+    '**/index.tsx',
+    '**/index.js',
+    '**/index.jsx',
+    '**/*.config.*',
+    '**/migrations/**',
+    '**/migrate/**',
+    '**/__init__.py',
+];
+exports.missingTestsCheck = {
+    name: 'Missing Tests',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.missingTests?.enabled !== false && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        // Scope the same way lint does — a client's `sourcePath` and `ignoreDirs`
+        // both apply, so generated/out-of-scope dirs never count as "new source".
+        const scopedList = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
+        if (scopedList === null)
+            return (0, types_1.skip)('git unavailable');
+        const scoped = new Set(scopedList);
+        const added = [];
+        const touched = [];
+        try {
+            const { stdout } = await (0, execa_1.execa)('git', [
+                'diff',
+                '--name-status',
+                '--diff-filter=ACM',
+                ctx.baseSha,
+                ctx.headSha ?? 'HEAD',
+            ], { cwd: ctx.cwd });
+            for (const line of stdout.split('\n')) {
+                if (!line)
+                    continue;
+                const [status, ...rest] = line.split('\t');
+                const file = rest.join('\t');
+                if (!file || !scoped.has(file))
+                    continue;
+                touched.push(file);
+                if (status === 'A')
+                    added.push(file);
+            }
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Missing Tests]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+        const ignore = ctx.config.missingTests?.ignore ?? DEFAULT_IGNORE;
+        const addedSource = added.filter(f => SOURCE_EXT.test(f) && !isTestFile(f) && !(0, utils_1.matchesAnyGlob)(f, ignore));
+        if (addedSource.length === 0)
+            return (0, types_1.pass)(); // no new source that would need a test
+        // A test added OR modified anywhere in scope satisfies the check.
+        if (touched.some(isTestFile))
+            return (0, types_1.pass)();
+        const sev = (0, findings_1.severityEmitter)(ctx.config.missingTests?.severity, 'warn');
+        addedSource
+            .slice(0, 5)
+            .forEach(f => sev.log(`[Missing Tests]: ${sev.icon} new source without tests: ${f}`));
+        if (addedSource.length > 5)
+            sev.log(`[Missing Tests]: ${sev.icon} ... and ${addedSource.length - 5} more`);
+        return sev.emit(`${addedSource.length} new source file(s) added without any test changes`);
+    },
+};

package/dist/core/checks/git/todo-fixme.d.ts

@@ -0,0 +1,7 @@
+import { Check } from '../../types';
+/**
+ * Flags leftover TODO/FIXME/XXX/HACK markers in Python and Kotlin/Java comments.
+ * JS/TS markers are already handled by the Diff Smells check, so this stays out
+ * of those globs to avoid double-reporting (same split as Leftover Debug).
+ */
+export declare const todoFixmeCheck: Check;

package/dist/core/checks/git/todo-fixme.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.todoFixmeCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const DEFAULT_KEYWORDS = ['TODO', 'FIXME', 'XXX', 'HACK'];
+/** A ticket reference in the comment: `#123` or JIRA-style `PROJ-456`. */
+const TICKET_PATTERN = /#\d+|[A-Z][A-Z0-9]+-\d+/;
+/**
+ * Build an added-line matcher for a comment style. `commentFragment` is a regex
+ * alternation of the language's comment openers (`#` for Python; `//`/`/*` for
+ * Kotlin/Java). Keywords are escaped and captured so the finding is labelled.
+ */
+function buildPattern(commentFragment, keywords) {
+    const kw = keywords.map(k => k.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+    return new RegExp(`^\\+.*(?:${commentFragment})\\s*(${kw})\\b`, 'i');
+}
+/** Bucket matching added lines by keyword, honouring opt-out and requireTicket. */
+function scan(stdout, pattern, requireTicket, findings) {
+    for (const line of stdout.split('\n')) {
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        const match = pattern.exec(line);
+        if (!match)
+            continue;
+        // With requireTicket, a marker that already links a ticket is acceptable.
+        if (requireTicket && TICKET_PATTERN.test(line))
+            continue;
+        const keyword = match[1].toUpperCase();
+        (findings[keyword] ?? (findings[keyword] = [])).push(line.slice(1).trim().substring(0, 100));
+    }
+}
+/**
+ * Flags leftover TODO/FIXME/XXX/HACK markers in Python and Kotlin/Java comments.
+ * JS/TS markers are already handled by the Diff Smells check, so this stays out
+ * of those globs to avoid double-reporting (same split as Leftover Debug).
+ */
+exports.todoFixmeCheck = {
+    name: 'TODO/FIXME',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.todoFixme?.enabled !== false &&
+            Boolean(ctx.baseSha) &&
+            (ctx.languages.includes('python') || ctx.languages.includes('kotlin')));
+    },
+    async run(ctx) {
+        try {
+            const cfg = ctx.config.todoFixme;
+            const keywords = cfg?.keywords ?? DEFAULT_KEYWORDS;
+            const requireTicket = cfg?.requireTicket ?? false;
+            const findings = {};
+            if (ctx.languages.includes('python')) {
+                scan(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), buildPattern('#', keywords), requireTicket, findings);
+            }
+            if (ctx.languages.includes('kotlin')) {
+                const ktPattern = buildPattern('//|/\\*', keywords);
+                scan(await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']), ktPattern, requireTicket, findings);
+            }
+            if ((0, findings_1.bucketTotal)(findings) === 0)
+                return (0, types_1.pass)();
+            const sev = (0, findings_1.severityEmitter)(cfg?.severity, 'warn');
+            (0, findings_1.logFindings)(findings, { prefix: 'TODO/FIXME', sampleLimit: 3, isError: sev.icon === '❌' });
+            const summary = Object.entries(findings)
+                .map(([label, arr]) => `${arr.length}× ${label}`)
+                .join(', ') + (requireTicket ? ' (no ticket reference)' : '');
+            return sev.emit(summary);
+        }
+        catch (err) {
+            utils_1.logger.warn(`[TODO/FIXME]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{cpp-format.d.ts → languages/cpp-format.d.ts}

@@ -1,4 +1,4 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 /**
  * Formats C/C++ code with clang-format, bundled as a self-contained WASM CLI
  * (`@wasm-fmt/clang-format`) so it runs on a bare Node image with no system

package/dist/core/checks/{cpp-format.js → languages/cpp-format.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cppFormatCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 /**
  * C/C++ source & header extensions clang-format understands. `.h` is intentionally
  * included even though it is ambiguous with C — clang-format handles both.

package/dist/core/checks/languages/csharp-format.d.ts

@@ -0,0 +1,13 @@
+import { Check } from '../../types';
+/**
+ * Formats/verifies C# code with `dotnet format` (which also runs the configured
+ * analyzers/whitespace/style rules). Runner-dependency: needs the .NET SDK on
+ * the runner, gracefully skipping when absent. Read-only in check mode
+ * (`--verify-no-changes`); rewrites in place with `dotnet format` when `write`,
+ * so CI can auto-commit — mirrors the other format checks.
+ *
+ * Note: `dotnet format` operates on the project/solution (needs a prior
+ * `dotnet restore`), so it runs over the whole project; the delta check only
+ * gates whether it runs at all.
+ */
+export declare const csharpFormatCheck: Check;

package/dist/core/checks/languages/csharp-format.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csharpFormatCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const CS_GLOBS = ['*.cs'];
+/**
+ * Formats/verifies C# code with `dotnet format` (which also runs the configured
+ * analyzers/whitespace/style rules). Runner-dependency: needs the .NET SDK on
+ * the runner, gracefully skipping when absent. Read-only in check mode
+ * (`--verify-no-changes`); rewrites in place with `dotnet format` when `write`,
+ * so CI can auto-commit — mirrors the other format checks.
+ *
+ * Note: `dotnet format` operates on the project/solution (needs a prior
+ * `dotnet restore`), so it runs over the whole project; the delta check only
+ * gates whether it runs at all.
+ */
+exports.csharpFormatCheck = {
+    name: 'C# Format',
+    phase: 'format',
+    applies(ctx) {
+        return ctx.config.csharp?.enabled !== false && ctx.languages.includes('csharp');
+    },
+    async run(ctx) {
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, CS_GLOBS);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_1.pass)('no C# files changed');
+        const check = await (0, execa_1.execa)('dotnet', ['format', '--verify-no-changes'], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
+        if (check.code === 'ENOENT')
+            return (0, types_1.skip)('dotnet SDK not installed');
+        if (check.exitCode === 0)
+            return (0, types_1.pass)();
+        if (!ctx.write) {
+            utils_1.logger.warn('[C# Format]: ⚠️ C# code needs formatting (dotnet format --verify-no-changes failed)');
+            return (0, types_1.warn)('C# code needs formatting (run with write to fix)');
+        }
+        const fix = await (0, execa_1.execa)('dotnet', ['format'], { cwd: ctx.cwd, reject: false });
+        if (fix.exitCode !== 0) {
+            utils_1.logger.warn(`[C# Format]: ⚠️ dotnet format failed\n${fix.stderr}`);
+            return (0, types_1.warn)('dotnet format failed to rewrite files');
+        }
+        utils_1.logger.info('[C# Format]: ✅ Reformatted C# code');
+        return (0, types_1.pass)('reformatted C# code');
+    },
+};

package/dist/core/checks/languages/go-format.d.ts

@@ -0,0 +1,8 @@
+import { Check } from '../../types';
+/**
+ * Formats changed Go files with `gofmt`. Runner-dependency (needs `gofmt` on the
+ * runner), gracefully skipping when absent. Read-only in check mode (`gofmt -l`
+ * lists files that differ from gofmt output); rewrites in place with `gofmt -w`
+ * when `write`, so CI can auto-commit — mirrors the Prettier/C++/Ruff format checks.
+ */
+export declare const goFormatCheck: Check;

package/dist/core/checks/languages/go-format.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.goFormatCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const GO_GLOBS = ['*.go'];
+/**
+ * Formats changed Go files with `gofmt`. Runner-dependency (needs `gofmt` on the
+ * runner), gracefully skipping when absent. Read-only in check mode (`gofmt -l`
+ * lists files that differ from gofmt output); rewrites in place with `gofmt -w`
+ * when `write`, so CI can auto-commit — mirrors the Prettier/C++/Ruff format checks.
+ */
+exports.goFormatCheck = {
+    name: 'Go Format',
+    phase: 'format',
+    applies(ctx) {
+        return ctx.config.go?.enabled !== false && ctx.languages.includes('go');
+    },
+    async run(ctx) {
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, GO_GLOBS);
+        if (targets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_1.pass)('no Go files changed');
+        const list = await (0, execa_1.execa)('gofmt', ['-l', ...targets], { cwd: ctx.cwd, reject: false });
+        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'` when
+        // the binary is absent — detect the missing toolchain on the result.
+        if (list.code === 'ENOENT')
+            return (0, types_1.skip)('gofmt not installed');
+        const unformatted = list.stdout.split('\n').filter(Boolean);
+        if (unformatted.length === 0)
+            return (0, types_1.pass)();
+        if (!ctx.write) {
+            utils_1.logger.warn(`[Go Format]: ⚠️ ${unformatted.length} Go file(s) need formatting`);
+            unformatted.slice(0, 10).forEach(f => utils_1.logger.warn(`  ${f}`));
+            return (0, types_1.warn)(`${unformatted.length} file(s) need formatting (run with write to fix)`);
+        }
+        const fix = await (0, execa_1.execa)('gofmt', ['-w', ...unformatted], { cwd: ctx.cwd, reject: false });
+        if (fix.exitCode !== 0) {
+            utils_1.logger.warn(`[Go Format]: ⚠️ gofmt -w failed\n${fix.stderr}`);
+            return (0, types_1.warn)('gofmt failed to rewrite files');
+        }
+        utils_1.logger.info(`[Go Format]: ✅ Reformatted ${unformatted.length} Go file(s)`);
+        return (0, types_1.pass)(`reformatted ${unformatted.length} file(s)`);
+    },
+};

package/dist/core/checks/languages/go-lint.d.ts

@@ -0,0 +1,8 @@
+import { Check } from '../../types';
+/**
+ * Vets changed Go code with `go vet ./...`. Runner-dependency: requires the Go
+ * toolchain on the runner (like SwiftLint/ktlint), and gracefully skips when
+ * `go` is absent. `go vet` operates per-package, so it runs over the module
+ * rather than a file list; the delta check only gates whether it runs at all.
+ */
+export declare const goLintCheck: Check;