pr-checkmate 1.22.8 → 1.23.0

package/dist/utils/detect-language.js

@@ -7,6 +7,7 @@ exports.detectLanguages = detectLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_1 = require("./execa");
+const glob_1 = require("./glob");
 const logger_1 = require("./logger");
 /**
  * Marker files that unambiguously indicate a language's presence, independent of
@@ -26,6 +27,13 @@ const MARKER_FILES = {
         'settings.gradle.kts',
         'AndroidManifest.xml',
     ],
+    go: ['go.mod'],
+    rust: ['Cargo.toml'],
+    // Glob markers (`*.csproj`/`*.sln`) — matched against root dir entries, since
+    // C# projects have no single fixed marker filename.
+    csharp: ['*.csproj', '*.sln'],
+    ruby: ['Gemfile', '.rubocop.yml'],
+    php: ['composer.json'],
 };
 /**
  * Source extensions per language, used to count tracked files via `git ls-files`.
@@ -37,9 +45,25 @@ const EXTENSIONS = {
     cpp: ['.cpp', '.cc', '.cxx', '.c++', '.hpp', '.hh', '.hxx'],
     swift: ['.swift'],
     kotlin: ['.kt', '.kts', '.java'],
+    go: ['.go'],
+    rust: ['.rs'],
+    csharp: ['.cs'],
+    ruby: ['.rb', '.rake'],
+    php: ['.php'],
 };
 function hasMarker(root, lang) {
-    return MARKER_FILES[lang].some(name => node_fs_1.default.existsSync(node_path_1.default.join(root, name)));
+    return MARKER_FILES[lang].some(name => {
+        if (!name.includes('*'))
+            return node_fs_1.default.existsSync(node_path_1.default.join(root, name));
+        // Glob marker (e.g. `*.csproj`): match against root-directory entries.
+        try {
+            const re = (0, glob_1.globToRegExp)(name);
+            return node_fs_1.default.readdirSync(root).some(entry => re.test(entry));
+        }
+        catch {
+            return false;
+        }
+    });
 }
 /**
  * Counts tracked files per language using `git ls-files`. Returns an empty map
@@ -54,6 +78,11 @@ async function countTrackedFiles(root) {
         cpp: 0,
         swift: 0,
         kotlin: 0,
+        go: 0,
+        rust: 0,
+        csharp: 0,
+        ruby: 0,
+        php: 0,
     };
     try {
         const { stdout } = await (0, execa_1.execa)('git', ['ls-files'], { cwd: root });
@@ -87,7 +116,7 @@ async function detectLanguages(root = process.cwd()) {
     const counts = await countTrackedFiles(root);
     const detected = Object.keys(EXTENSIONS).filter(lang => hasMarker(root, lang) || counts[lang] > 0);
     detected.sort((a, b) => counts[b] - counts[a]);
-    logger_1.logger.info(`[detectLanguages]: Detected ${detected.length ? detected.join(', ') : 'none'} ` +
-        `(counts: ts=${counts.typescript}, js=${counts.javascript}, py=${counts.python}, cpp=${counts.cpp}, swift=${counts.swift}, kt=${counts.kotlin})`);
+    const countStr = Object.keys(counts).map(l => `${l}=${counts[l]}`).join(', ');
+    logger_1.logger.info(`[detectLanguages]: Detected ${detected.length ? detected.join(', ') : 'none'} (counts: ${countStr})`);
     return detected;
 }

package/dist/utils/glob.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Minimal glob → RegExp for path matching against config patterns. Supports `*`
+ * (matches within a path segment), `**` (across segments), and a leading `** /`
+ * that also matches the repo root (zero segments). Anchored to the whole path.
+ * Not a full glob implementation — enough for the allow/ignore lists in
+ * pr-checkmate.json (e.g. "assets/**", "*.png", "** / *.d.ts").
+ */
+export declare function globToRegExp(glob: string): RegExp;
+/** True when `file` matches any of the glob `patterns`. */
+export declare function matchesAnyGlob(file: string, patterns: string[]): boolean;

package/dist/utils/glob.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globToRegExp = globToRegExp;
+exports.matchesAnyGlob = matchesAnyGlob;
+/**
+ * Minimal glob → RegExp for path matching against config patterns. Supports `*`
+ * (matches within a path segment), `**` (across segments), and a leading `** /`
+ * that also matches the repo root (zero segments). Anchored to the whole path.
+ * Not a full glob implementation — enough for the allow/ignore lists in
+ * pr-checkmate.json (e.g. "assets/**", "*.png", "** / *.d.ts").
+ */
+function globToRegExp(glob) {
+    const re = glob
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&') // escape regex specials (not * or /)
+        .replace(/\*\*\//g, ' dir ') // `**/` → optional leading dirs (matches root too)
+        .replace(/\*\*/g, ' any ') // bare `**` → across segments
+        .replace(/\*/g, '[^/]*') // `*` → within a segment
+        .replace(/ dir /g, '(?:.*/)?')
+        .replace(/ any /g, '.*');
+    return new RegExp(`^${re}$`);
+}
+/** True when `file` matches any of the glob `patterns`. */
+function matchesAnyGlob(file, patterns) {
+    return patterns.some(p => globToRegExp(p).test(file));
+}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@ export * from './result-collector';
 export * from './resolve-bin';
 export * from './own-deps';
 export * from './detect-language';
+export * from './glob';
 /**
  *
  */

package/dist/utils/index.js

@@ -25,6 +25,7 @@ __exportStar(require("./result-collector"), exports);
 __exportStar(require("./resolve-bin"), exports);
 __exportStar(require("./own-deps"), exports);
 __exportStar(require("./detect-language"), exports);
+__exportStar(require("./glob"), exports);
 /**
  *
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.22.8",
+    "version": "1.23.0",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -34,6 +34,7 @@
         ".prettierrc",
         "cspell.json",
         "src/config/pr-checkmate-workflow.yml",
+        "pr-checkmate.schema.json",
         ".markdownlint.json",
         "gitleaks.toml",
         "LICENSE"

package/pr-checkmate.schema.json

@@ -0,0 +1,166 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "PR CheckMate configuration",
+  "description": "Config for pr-checkmate. Unknown keys are reported by the Config Validation check.",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "$schema": { "type": "string" },
+    "sourcePath": {
+      "description": "Directory (or directories) checks are scoped to. Defaults to '.'.",
+      "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
+    },
+    "ignoreDirs": {
+      "description": "Directory names excluded from every check.",
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "severity": {
+      "description": "Universal per-check severity override, keyed by the check's display name.",
+      "type": "object",
+      "additionalProperties": { "enum": ["error", "warn", "off"] }
+    },
+    "customRules": {
+      "description": "User-defined regex rules run against the diff.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "pattern"],
+        "properties": {
+          "name": { "type": "string" },
+          "pattern": { "type": "string" },
+          "message": { "type": "string" },
+          "severity": { "enum": ["error", "warn"] },
+          "include": { "type": "array", "items": { "type": "string" } },
+          "exclude": { "type": "array", "items": { "type": "string" } },
+          "flags": { "type": "string" }
+        }
+      }
+    },
+    "bannedImports": {
+      "description": "Dependencies/imports that must not be added.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name"],
+        "properties": {
+          "name": { "type": "string" },
+          "message": { "type": "string" },
+          "severity": { "enum": ["error", "warn"] }
+        }
+      }
+    },
+    "prSize": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "maxFiles": { "type": "number" },
+        "maxLines": { "type": "number" }
+      }
+    },
+    "largeFiles": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "maxSizeKb": { "type": "number" },
+        "allow": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "licenseHeader": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "pattern": { "type": "string" },
+        "lines": { "type": "number" }
+      }
+    },
+    "coverage": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "reportPath": {
+          "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
+        }
+      }
+    },
+    "vulnScan": {
+      "type": "object",
+      "properties": { "enabled": { "type": "boolean" } }
+    },
+    "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
+    "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
+    "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },
+    "missingTests": { "$ref": "#/$defs/toggleSeverity" },
+    "diffSecurity": { "$ref": "#/$defs/toggleIgnore" },
+    "workflowSecurity": { "$ref": "#/$defs/toggleIgnore" },
+    "dockerfileSecurity": { "$ref": "#/$defs/toggleIgnore" },
+    "migrationSafety": { "$ref": "#/$defs/toggleSeverity" },
+    "todoFixme": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "requireTicket": { "type": "boolean" },
+        "keywords": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "diffSmell": { "$ref": "#/$defs/toggle" },
+    "caseCollision": { "$ref": "#/$defs/toggle" },
+    "sensitiveFileGuard": { "$ref": "#/$defs/toggle" },
+    "configValidation": { "$ref": "#/$defs/toggle" },
+    "typecheck": { "$ref": "#/$defs/toggle" },
+    "prBody": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "minLength": { "type": "number" },
+        "requireTicket": { "type": "boolean" }
+      }
+    },
+    "cpp": { "$ref": "#/$defs/toggle" },
+    "python": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "typecheck": { "type": "boolean" },
+        "typeChecker": { "enum": ["mypy", "pyright"] },
+        "ruff": {
+          "type": "object",
+          "properties": {
+            "lint": { "type": "boolean" },
+            "format": { "type": "boolean" }
+          }
+        }
+      }
+    },
+    "swift": { "$ref": "#/$defs/toggle" },
+    "kotlin": { "$ref": "#/$defs/toggle" },
+    "go": { "$ref": "#/$defs/toggle" },
+    "rust": { "$ref": "#/$defs/toggle" },
+    "csharp": { "$ref": "#/$defs/toggle" },
+    "ruby": { "$ref": "#/$defs/toggle" },
+    "php": { "$ref": "#/$defs/toggle" }
+  },
+  "$defs": {
+    "toggle": {
+      "type": "object",
+      "properties": { "enabled": { "type": "boolean" } }
+    },
+    "toggleSeverity": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] }
+      }
+    },
+    "toggleIgnore": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    }
+  }
+}

package/src/config/cspell.json

@@ -693,7 +693,15 @@
     "litert",
     "SHTPB",
     "FUTX",
-    "subdirs"
+    "subdirs",
+    "clippy",
+    "mypy",
+    "pyright",
+    "jacoco",
+    "depcheckrc",
+    "gofmt",
+    "dotnet",
+    "rubocop"
   ],
   "ignorePaths": [
     "**/node_modules/**",

package/src/config/pr-checkmate.schema.json

@@ -0,0 +1,166 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "PR CheckMate configuration",
+  "description": "Config for pr-checkmate. Unknown keys are reported by the Config Validation check.",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "$schema": { "type": "string" },
+    "sourcePath": {
+      "description": "Directory (or directories) checks are scoped to. Defaults to '.'.",
+      "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
+    },
+    "ignoreDirs": {
+      "description": "Directory names excluded from every check.",
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "severity": {
+      "description": "Universal per-check severity override, keyed by the check's display name.",
+      "type": "object",
+      "additionalProperties": { "enum": ["error", "warn", "off"] }
+    },
+    "customRules": {
+      "description": "User-defined regex rules run against the diff.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "pattern"],
+        "properties": {
+          "name": { "type": "string" },
+          "pattern": { "type": "string" },
+          "message": { "type": "string" },
+          "severity": { "enum": ["error", "warn"] },
+          "include": { "type": "array", "items": { "type": "string" } },
+          "exclude": { "type": "array", "items": { "type": "string" } },
+          "flags": { "type": "string" }
+        }
+      }
+    },
+    "bannedImports": {
+      "description": "Dependencies/imports that must not be added.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name"],
+        "properties": {
+          "name": { "type": "string" },
+          "message": { "type": "string" },
+          "severity": { "enum": ["error", "warn"] }
+        }
+      }
+    },
+    "prSize": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "maxFiles": { "type": "number" },
+        "maxLines": { "type": "number" }
+      }
+    },
+    "largeFiles": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "maxSizeKb": { "type": "number" },
+        "allow": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "licenseHeader": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "pattern": { "type": "string" },
+        "lines": { "type": "number" }
+      }
+    },
+    "coverage": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "reportPath": {
+          "oneOf": [{ "type": "string" }, { "type": "array", "items": { "type": "string" } }]
+        }
+      }
+    },
+    "vulnScan": {
+      "type": "object",
+      "properties": { "enabled": { "type": "boolean" } }
+    },
+    "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
+    "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
+    "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },
+    "missingTests": { "$ref": "#/$defs/toggleSeverity" },
+    "diffSecurity": { "$ref": "#/$defs/toggleIgnore" },
+    "workflowSecurity": { "$ref": "#/$defs/toggleIgnore" },
+    "dockerfileSecurity": { "$ref": "#/$defs/toggleIgnore" },
+    "migrationSafety": { "$ref": "#/$defs/toggleSeverity" },
+    "todoFixme": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "requireTicket": { "type": "boolean" },
+        "keywords": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "diffSmell": { "$ref": "#/$defs/toggle" },
+    "caseCollision": { "$ref": "#/$defs/toggle" },
+    "sensitiveFileGuard": { "$ref": "#/$defs/toggle" },
+    "configValidation": { "$ref": "#/$defs/toggle" },
+    "typecheck": { "$ref": "#/$defs/toggle" },
+    "prBody": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "minLength": { "type": "number" },
+        "requireTicket": { "type": "boolean" }
+      }
+    },
+    "cpp": { "$ref": "#/$defs/toggle" },
+    "python": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "typecheck": { "type": "boolean" },
+        "typeChecker": { "enum": ["mypy", "pyright"] },
+        "ruff": {
+          "type": "object",
+          "properties": {
+            "lint": { "type": "boolean" },
+            "format": { "type": "boolean" }
+          }
+        }
+      }
+    },
+    "swift": { "$ref": "#/$defs/toggle" },
+    "kotlin": { "$ref": "#/$defs/toggle" },
+    "go": { "$ref": "#/$defs/toggle" },
+    "rust": { "$ref": "#/$defs/toggle" },
+    "csharp": { "$ref": "#/$defs/toggle" },
+    "ruby": { "$ref": "#/$defs/toggle" },
+    "php": { "$ref": "#/$defs/toggle" }
+  },
+  "$defs": {
+    "toggle": {
+      "type": "object",
+      "properties": { "enabled": { "type": "boolean" } }
+    },
+    "toggleSeverity": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] }
+      }
+    },
+    "toggleIgnore": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    }
+  }
+}

package/dist/core/checks/diff-security.js

@@ -1,145 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.diffSecurityCheck = void 0;
-const utils_1 = require("../../utils");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
-const SECURITY_PATTERNS = [
-    {
-        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
-        label: 'dangerouslySetInnerHTML (XSS risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
-        label: 'innerHTML assignment (XSS risk)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*document\.write\s*\(/,
-        label: 'document.write() (XSS risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
-        label: 'eval() (code injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
-        label: 'new Function() (code injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
-        label: '__proto__ mutation (prototype pollution)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
-        label: 'constructor.prototype access (prototype pollution)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
-        label: 'MD5 (weak hash — use sha256 or stronger)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
-        label: 'SHA-1 (weak hash — use sha256 or stronger)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
-        label: 'deprecated createDecipher() — use createDecipheriv()',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
-        label: 'deprecated createCipher() — use createCipheriv()',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
-        label: "CORS wildcard origin: '*' (allows any domain)",
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
-        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
-        label: 'Insecure HTTP (non-HTTPS) in external call',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
-        label: 'exec/spawn with template literal (command injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
-        label: 'exec/spawn with string concatenation (command injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
-        label: 'SQL query with template literal interpolation (SQL injection risk)',
-        severity: 'error',
-    },
-    {
-        // A quoted string that contains a whole SQL keyword, concatenated with a
-        // variable — the real injection shape. Word boundaries + the quote context
-        // stop identifiers like `insertions + deletions` from false-positiving.
-        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
-        label: 'SQL string concatenation (SQL injection risk)',
-        severity: 'error',
-    },
-];
-/** Bucket added-line matches by severity, keyed by pattern label. */
-function scanDiff(stdout) {
-    const errors = {};
-    const warnings = {};
-    for (const line of stdout.split('\n')) {
-        for (const { pattern, label, severity } of SECURITY_PATTERNS) {
-            if (pattern.test(line)) {
-                const bucket = severity === 'error' ? errors : warnings;
-                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-            }
-        }
-    }
-    return { errors, warnings };
-}
-exports.diffSecurityCheck = {
-    name: 'Diff Security',
-    phase: 'informational',
-    applies(ctx) {
-        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
-    },
-    async run(ctx) {
-        try {
-            const stdout = await (0, findings_1.diffAddedLines)(ctx, [
-                '*.ts',
-                '*.tsx',
-                '*.js',
-                '*.jsx',
-                '*.mjs',
-                '*.cjs',
-            ]);
-            const { errors, warnings } = scanDiff(stdout);
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
-                prefix: 'Diff Security',
-                errorSummary: n => `${n} issue(s)`,
-                warningSummary: n => `${n} warning(s)`,
-                sampleLimit: 3,
-            });
-        }
-        catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
-        }
-    },
-};