pr-checkmate 1.22.8 → 1.23.1

package/dist/core/registry.js

@@ -1,40 +1,62 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REGISTRY = void 0;
-// blocking — a failure here makes the whole run fail (report.ok === false)
-const circular_deps_1 = require("./checks/circular-deps");
-const commitlint_1 = require("./checks/commitlint");
-const cpp_format_1 = require("./checks/cpp-format");
-const dead_code_1 = require("./checks/dead-code");
-const dependency_check_1 = require("./checks/dependency-check");
-const diff_security_1 = require("./checks/diff-security");
-const diff_smell_1 = require("./checks/diff-smell");
-const duplicate_check_1 = require("./checks/duplicate-check");
-const kotlin_lint_1 = require("./checks/kotlin-lint");
-const license_check_1 = require("./checks/license-check");
-const lint_1 = require("./checks/lint");
-const markdown_lint_1 = require("./checks/markdown-lint");
-const npm_audit_1 = require("./checks/npm-audit");
-// informational — warn/skip only, never fail the run
-const outdated_deps_1 = require("./checks/outdated-deps");
-const pr_body_1 = require("./checks/pr-body");
-const pr_size_check_1 = require("./checks/pr-size-check");
-const pr_title_lint_1 = require("./checks/pr-title-lint");
-const prettier_1 = require("./checks/prettier");
-const python_format_1 = require("./checks/python-format");
-const python_lint_1 = require("./checks/python-lint");
-const security_1 = require("./checks/security");
-const sensitive_file_guard_1 = require("./checks/sensitive-file-guard");
-const spellcheck_1 = require("./checks/spellcheck");
-const swift_lint_1 = require("./checks/swift-lint");
-// format — runs last, may write files
-const typecheck_1 = require("./checks/typecheck");
+const banned_imports_1 = require("./checks/dependencies/banned-imports");
+const circular_deps_1 = require("./checks/dependencies/circular-deps");
+const dependency_check_1 = require("./checks/dependencies/dependency-check");
+const license_check_1 = require("./checks/dependencies/license-check");
+const npm_audit_1 = require("./checks/dependencies/npm-audit");
+const outdated_deps_1 = require("./checks/dependencies/outdated-deps");
+const vuln_scan_1 = require("./checks/dependencies/vuln-scan");
+const custom_rules_1 = require("./checks/git/custom-rules");
+const diff_smell_1 = require("./checks/git/diff-smell");
+const large_files_1 = require("./checks/git/large-files");
+const leftover_debug_1 = require("./checks/git/leftover-debug");
+const lockfile_drift_1 = require("./checks/git/lockfile-drift");
+const merge_conflict_1 = require("./checks/git/merge-conflict");
+const missing_tests_1 = require("./checks/git/missing-tests");
+const todo_fixme_1 = require("./checks/git/todo-fixme");
+const cpp_format_1 = require("./checks/languages/cpp-format");
+const csharp_format_1 = require("./checks/languages/csharp-format");
+const go_format_1 = require("./checks/languages/go-format");
+const go_lint_1 = require("./checks/languages/go-lint");
+const kotlin_lint_1 = require("./checks/languages/kotlin-lint");
+const lint_1 = require("./checks/languages/lint");
+const php_format_1 = require("./checks/languages/php-format");
+const prettier_1 = require("./checks/languages/prettier");
+const python_format_1 = require("./checks/languages/python-format");
+const python_lint_1 = require("./checks/languages/python-lint");
+const python_typecheck_1 = require("./checks/languages/python-typecheck");
+const ruby_lint_1 = require("./checks/languages/ruby-lint");
+const rust_format_1 = require("./checks/languages/rust-format");
+const rust_lint_1 = require("./checks/languages/rust-lint");
+const swift_lint_1 = require("./checks/languages/swift-lint");
+const typecheck_1 = require("./checks/languages/typecheck");
+const commitlint_1 = require("./checks/pr/commitlint");
+const pr_body_1 = require("./checks/pr/pr-body");
+const pr_size_check_1 = require("./checks/pr/pr-size-check");
+const pr_title_lint_1 = require("./checks/pr/pr-title-lint");
+const case_collision_1 = require("./checks/quality/case-collision");
+const config_validation_1 = require("./checks/quality/config-validation");
+const coverage_1 = require("./checks/quality/coverage");
+const dead_code_1 = require("./checks/quality/dead-code");
+const duplicate_check_1 = require("./checks/quality/duplicate-check");
+const license_header_1 = require("./checks/quality/license-header");
+const markdown_lint_1 = require("./checks/quality/markdown-lint");
+const spellcheck_1 = require("./checks/quality/spellcheck");
+const diff_security_1 = require("./checks/security/diff-security");
+const dockerfile_security_1 = require("./checks/security/dockerfile-security");
+const migration_safety_1 = require("./checks/security/migration-safety");
+const security_1 = require("./checks/security/security");
+const sensitive_file_guard_1 = require("./checks/security/sensitive-file-guard");
+const workflow_security_1 = require("./checks/security/workflow-security");
 /**
  * Every check, in declaration order. The orchestrator groups them by `phase`
  * (blocking → informational → format) and runs each phase's checks in parallel.
  */
 exports.REGISTRY = [
     // blocking
+    merge_conflict_1.mergeConflictCheck,
     security_1.securityCheck,
     typecheck_1.typecheckCheck,
     lint_1.lintCheck,
@@ -45,6 +67,21 @@ exports.REGISTRY = [
     // informational
     diff_smell_1.diffSmellCheck,
     diff_security_1.diffSecurityCheck,
+    workflow_security_1.workflowSecurityCheck,
+    dockerfile_security_1.dockerfileSecurityCheck,
+    case_collision_1.caseCollisionCheck,
+    vuln_scan_1.vulnScanCheck,
+    custom_rules_1.customRulesCheck,
+    banned_imports_1.bannedImportsCheck,
+    license_header_1.licenseHeaderCheck,
+    config_validation_1.configValidationCheck,
+    leftover_debug_1.leftoverDebugCheck,
+    lockfile_drift_1.lockfileDriftCheck,
+    large_files_1.largeFilesCheck,
+    todo_fixme_1.todoFixmeCheck,
+    missing_tests_1.missingTestsCheck,
+    coverage_1.coverageCheck,
+    migration_safety_1.migrationSafetyCheck,
     sensitive_file_guard_1.sensitiveFileGuardCheck,
     pr_body_1.prBodyCheck,
     duplicate_check_1.duplicateCheck,
@@ -55,11 +92,19 @@ exports.REGISTRY = [
     markdown_lint_1.markdownLintCheck,
     spellcheck_1.spellcheckCheck,
     python_lint_1.pythonLintCheck,
+    python_typecheck_1.pythonTypecheckCheck,
     dead_code_1.deadCodeCheck,
     swift_lint_1.swiftLintCheck,
     kotlin_lint_1.kotlinLintCheck,
+    go_lint_1.goLintCheck,
+    rust_lint_1.rustLintCheck,
+    ruby_lint_1.rubyLintCheck,
     // format
     prettier_1.prettierCheck,
     cpp_format_1.cppFormatCheck,
     python_format_1.pythonFormatCheck,
+    go_format_1.goFormatCheck,
+    rust_format_1.rustFormatCheck,
+    csharp_format_1.csharpFormatCheck,
+    php_format_1.phpFormatCheck,
 ];

package/dist/core/reporters.d.ts

@@ -1,6 +1,7 @@
-import type { CheckReport } from './types';
+import type { CheckReport, ReporterKind } from './types';
 /**
  * Emit the report through the selected channel.
- * none: nothing · stdout: console table · github: table + upsert PR comment.
+ * none: nothing · stdout: console table · github/gitlab/bitbucket: table +
+ * upsert the PR/MR comment · auto: detect the platform from the environment.
  */
-export declare function report(kind: 'none' | 'stdout' | 'github', result: CheckReport): Promise<void>;
+export declare function report(kind: ReporterKind, result: CheckReport): Promise<void>;

package/dist/core/reporters.js

@@ -69,6 +69,8 @@ function printStdout(report) {
     utils_1.logger.info(SUMMARY_RULE);
     utils_1.logger.info(`  ✅ ${passed} passed  ⚠️ ${warned} warnings  ❌ ${failed} failed  ⏭️ ${skipped} skipped`);
     utils_1.logger.info(SUMMARY_BORDER);
+    // Always shown under the report — the docs cover every check and config key.
+    utils_1.logger.info(' DOCUMENTATION: https://pr-checkmate-docs.pages.dev/');
 }
 async function upsertGithubComment(body) {
     const ctx = getPrContext();
@@ -110,15 +112,115 @@ async function upsertGithubComment(body) {
         utils_1.logger.warn(`[reporter]: ⚠️ Could not post GitHub comment: ${err}`);
     }
 }
+/**
+ * Upsert a GitLab MR note (find our marker → update, else create). Uses the
+ * standard CI variables plus a `GITLAB_TOKEN` with `api` scope. Skips gracefully
+ * when not in an MR pipeline or the token is missing.
+ */
+async function upsertGitlabNote(body) {
+    const base = process.env.CI_API_V4_URL;
+    const project = process.env.CI_PROJECT_ID;
+    const iid = process.env.CI_MERGE_REQUEST_IID;
+    const token = process.env.GITLAB_TOKEN;
+    if (!base || !project || !iid || !token) {
+        utils_1.logger.info('[reporter]: Skipping GitLab note (not an MR pipeline or GITLAB_TOKEN missing)');
+        return;
+    }
+    const notes = `${base}/projects/${project}/merge_requests/${iid}/notes`;
+    const headers = { 'PRIVATE-TOKEN': token, 'Content-Type': 'application/json' };
+    try {
+        const listRes = await fetch(notes, { headers });
+        if (listRes.ok) {
+            const existing = (await listRes.json()).find(n => typeof n.body === 'string' && n.body.includes(COMMENT_MARKER));
+            if (existing) {
+                await fetch(`${notes}/${existing.id}`, {
+                    method: 'PUT',
+                    headers,
+                    body: JSON.stringify({ body }),
+                });
+                utils_1.logger.info('[reporter]: ✅ Updated PR CheckMate note on GitLab MR');
+                return;
+            }
+        }
+        await fetch(notes, { method: 'POST', headers, body: JSON.stringify({ body }) });
+        utils_1.logger.info('[reporter]: ✅ Posted PR CheckMate summary to GitLab MR');
+    }
+    catch (err) {
+        utils_1.logger.warn(`[reporter]: ⚠️ Could not post GitLab note: ${err}`);
+    }
+}
+/**
+ * Upsert a Bitbucket PR comment (find our marker → update, else create). Uses
+ * Bitbucket Pipelines variables plus a `BITBUCKET_TOKEN` (repo/PR write). Skips
+ * gracefully when not in a PR pipeline or the token is missing.
+ */
+async function upsertBitbucketComment(body) {
+    const fullName = process.env.BITBUCKET_REPO_FULL_NAME;
+    const prId = process.env.BITBUCKET_PR_ID;
+    const token = process.env.BITBUCKET_TOKEN;
+    if (!fullName || !prId || !token) {
+        utils_1.logger.info('[reporter]: Skipping Bitbucket comment (not a PR pipeline or BITBUCKET_TOKEN missing)');
+        return;
+    }
+    const commentsUrl = `https://api.bitbucket.org/2.0/repositories/${fullName}/pullrequests/${prId}/comments`;
+    const headers = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' };
+    try {
+        const listRes = await fetch(`${commentsUrl}?pagelen=100`, { headers });
+        if (listRes.ok) {
+            const values = (await listRes.json()).values;
+            const existing = values?.find(c => c.content?.raw?.includes(COMMENT_MARKER));
+            if (existing) {
+                await fetch(`${commentsUrl}/${existing.id}`, {
+                    method: 'PUT',
+                    headers,
+                    body: JSON.stringify({ content: { raw: body } }),
+                });
+                utils_1.logger.info('[reporter]: ✅ Updated PR CheckMate comment on Bitbucket PR');
+                return;
+            }
+        }
+        await fetch(commentsUrl, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ content: { raw: body } }),
+        });
+        utils_1.logger.info('[reporter]: ✅ Posted PR CheckMate summary to Bitbucket PR');
+    }
+    catch (err) {
+        utils_1.logger.warn(`[reporter]: ⚠️ Could not post Bitbucket comment: ${err}`);
+    }
+}
+/** Detect the CI platform from the environment, or null when unknown/local. */
+function detectPlatform() {
+    if (process.env.GITHUB_ACTIONS || process.env.GITHUB_EVENT_NAME)
+        return 'github';
+    if (process.env.GITLAB_CI)
+        return 'gitlab';
+    if (process.env.BITBUCKET_PIPELINE_UUID || process.env.BITBUCKET_PR_ID)
+        return 'bitbucket';
+    return null;
+}
+/** Post the markdown report to a specific platform's PR/MR. */
+async function postToPlatform(platform, result) {
+    const body = buildMarkdownReport(result);
+    if (platform === 'github')
+        return upsertGithubComment(body);
+    if (platform === 'gitlab')
+        return upsertGitlabNote(body);
+    return upsertBitbucketComment(body);
+}
 /**
  * Emit the report through the selected channel.
- * none: nothing · stdout: console table · github: table + upsert PR comment.
+ * none: nothing · stdout: console table · github/gitlab/bitbucket: table +
+ * upsert the PR/MR comment · auto: detect the platform from the environment.
  */
 async function report(kind, result) {
     if (kind === 'none')
         return;
     printStdout(result);
-    if (kind === 'github' && result.results.length > 0) {
-        await upsertGithubComment(buildMarkdownReport(result));
-    }
+    if (result.results.length === 0)
+        return;
+    const platform = kind === 'auto' ? detectPlatform() : kind === 'stdout' ? null : kind;
+    if (platform)
+        await postToPlatform(platform, result);
 }

package/dist/core/run-checks.js

@@ -50,6 +50,20 @@ function selectChecks(checks, opts) {
 function errMessage(err) {
     return err instanceof Error ? err.message.split('\n')[0].slice(0, 160) : String(err);
 }
+/**
+ * Apply the universal `config.severity` override for a check. Only remaps
+ * between warn↔fail (pass/skip are never changed); `off` is handled earlier by
+ * excluding the check from the run entirely. This is what lets a repo turn any
+ * advisory check into a gate, or downgrade a blocking one, by name.
+ */
+function applySeverity(name, status, ctx) {
+    const sev = ctx.config.severity?.[name];
+    if (sev === 'error' && status === 'warn')
+        return 'fail';
+    if (sev === 'warn' && status === 'fail')
+        return 'warn';
+    return status;
+}
 /** Run one check: gate on `applies`, execute, translate throws into `fail`. */
 async function runOne(check, ctx, collector) {
     try {
@@ -63,12 +77,13 @@ async function runOne(check, ctx, collector) {
             return;
         }
         const outcome = await check.run(ctx);
-        collector.register(check.name, outcome.status, outcome.details);
+        collector.register(check.name, applySeverity(check.name, outcome.status, ctx), outcome.details);
     }
     catch (err) {
         // An unexpected throw in a blocking check fails the run; in informational/format
         // phases it only warns — those phases never block, matching the legacy pipeline.
-        const status = check.phase === 'blocking' ? 'fail' : 'warn';
+        const base = check.phase === 'blocking' ? 'fail' : 'warn';
+        const status = applySeverity(check.name, base, ctx);
         utils_1.logger.error(`[runChecks]: ${status === 'fail' ? '❌' : '⚠️'} ${check.name} threw: ${err}`);
         collector.register(check.name, status, errMessage(err));
     }
@@ -82,7 +97,10 @@ async function runOne(check, ctx, collector) {
  */
 async function runChecks(opts = {}) {
     const ctx = await (0, context_1.buildContext)(opts);
-    const selected = selectChecks(resolveChecks(opts), opts);
+    // `severity: { "<name>": "off" }` disables any check by name, universally —
+    // a superset of the per-check `enabled: false` flags.
+    const off = ctx.config.severity ?? {};
+    const selected = selectChecks(resolveChecks(opts), opts).filter(c => off[c.name] !== 'off');
     const collector = new result_collector_1.ResultCollector();
     for (const phase of types_1.PHASES) {
         const inPhase = selected.filter(c => c.phase === phase);

package/dist/core/targets.d.ts

@@ -6,7 +6,10 @@ import type { CheckContext } from './types';
  * `null` when git itself is unusable (caller should `skip`).
  *
  * Only ACMR files are returned (Added/Copied/Modified/Renamed) — deletions are
- * excluded, so every returned path exists on disk and is safe to read.
+ * excluded. Results are additionally filtered to paths that still exist on disk,
+ * so a rename/move within the diff range (where the old path shows up but no
+ * longer exists) can never hand a missing path to a downstream tool like ESLint
+ * or Prettier, which crash hard on a non-existent pattern.
  */
 export declare function resolveTargetFiles(ctx: CheckContext, globs: string[]): Promise<string[] | null>;
 /**

package/dist/core/targets.js

@@ -1,8 +1,13 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveTargetFiles = resolveTargetFiles;
 exports.resolveScopedTargetFiles = resolveScopedTargetFiles;
 exports.listTrackedFiles = listTrackedFiles;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../config");
 const utils_1 = require("../utils");
 const execa_1 = require("../utils/execa");
@@ -25,7 +30,10 @@ function excludeIgnoredDirs(files) {
  * `null` when git itself is unusable (caller should `skip`).
  *
  * Only ACMR files are returned (Added/Copied/Modified/Renamed) — deletions are
- * excluded, so every returned path exists on disk and is safe to read.
+ * excluded. Results are additionally filtered to paths that still exist on disk,
+ * so a rename/move within the diff range (where the old path shows up but no
+ * longer exists) can never hand a missing path to a downstream tool like ESLint
+ * or Prettier, which crash hard on a non-existent pattern.
  */
 async function resolveTargetFiles(ctx, globs) {
     try {
@@ -40,11 +48,16 @@ async function resolveTargetFiles(ctx, globs) {
                 ...globs,
             ]
             : ['ls-files', ...globs];
-        const { stdout } = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd, reject: false });
+        const cacheKey = `t:${args.join('
')}`;
+        let stdout = ctx.cache?.get(cacheKey);
+        if (stdout === undefined) {
+            stdout = (await (0, execa_1.execa)('git', args, { cwd: ctx.cwd, reject: false })).stdout;
+            ctx.cache?.set(cacheKey, stdout);
+        }
         const files = excludeIgnoredDirs(stdout
             .split('\n')
             .map(f => f.trim())
-            .filter(Boolean));
+            .filter(Boolean)).filter(f => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, f)));
         utils_1.logger.info(`[targets]: ${ctx.baseSha ? '📂 Delta' : 'Full scan'}: ${files.length} file(s) for ${globs.join(', ')}`);
         return files;
     }

package/dist/core/types.d.ts

@@ -24,6 +24,12 @@ export interface CheckContext {
     /** Diff range for delta-aware checks; undefined → full-repo scan. */
     baseSha?: string;
     headSha?: string;
+    /**
+     * Per-run memoization cache for identical git invocations (many checks diff
+     * the same range). Created once per `runChecks`; safe because git state is
+     * stable within a run. Keyed by the git args.
+     */
+    cache?: Map<string, string>;
 }
 /** Outcome of a single check — the name is attached by the orchestrator. */
 export interface CheckOutcome {
@@ -42,7 +48,7 @@ export interface Check {
     applies(ctx: CheckContext): boolean | Promise<boolean>;
     run(ctx: CheckContext): Promise<CheckOutcome>;
 }
-export type ReporterKind = 'none' | 'stdout' | 'github';
+export type ReporterKind = 'none' | 'stdout' | 'github' | 'gitlab' | 'bitbucket' | 'auto';
 /** Custom reporter: receives the final report to emit however the consumer wants. */
 export type ReporterFn = (report: CheckReport) => void | Promise<void>;
 export interface RunOptions {
@@ -78,6 +84,12 @@ export interface RunOptions {
     config?: PRCheckMateConfig;
     baseSha?: string;
     headSha?: string;
+    /**
+     * Pre-commit / local mode: check the staged changes (index vs HEAD) instead of
+     * a PR range. Implemented by diffing HEAD against the index tree
+     * (`git write-tree`), so every delta-aware check works unchanged.
+     */
+    staged?: boolean;
 }
 export interface CheckReport {
     results: CheckResult[];

package/dist/init.js

@@ -28,6 +28,18 @@ function loadDefaultEslintRules() {
  * Default configuration structure with customization options
  */
 const DEFAULT_CONFIG = {
+    // Points editors (VS Code, etc.) at the bundled JSON schema for autocomplete
+    // and inline validation of this file.
+    $schema: './node_modules/pr-checkmate/pr-checkmate.schema.json',
+    // Human-readable hints. JSON has no comments, so these `//`-prefixed keys are
+    // just informational strings — PR CheckMate ignores them at runtime.
+    '// reporting': [
+        'Results post to the PR/MR automatically.',
+        'GitHub: no setup — the runner injects GITHUB_TOKEN; just keep `permissions: pull-requests: write` in the workflow.',
+        'GitLab: create a token (Project → Settings → Access Tokens, scope `api`) and add it as CI/CD variable GITLAB_TOKEN.',
+        'Bitbucket: create a token (Repo → Settings → Access tokens, scope pull-requests:write) and add it as repo variable BITBUCKET_TOKEN.',
+        'The token lives in YOUR CI variables, never in this file. Without it, checks still run and print to the log — only the comment is skipped.',
+    ].join(' '),
     sourcePath: '.',
     // Directories excluded from every check (matched on any path segment). Edit
     // freely — add your own generated/vendored dirs or remove ones you want scanned.
@@ -94,6 +106,57 @@ const DEFAULT_CONFIG = {
         // test runner. Add barrels/entry points here to exempt intentional exports.
         ignoreFiles: config_1.DEAD_CODE_IGNORE_DEFAULTS,
     },
+    // User-defined rules: regex patterns run against added diff lines. The escape
+    // hatch to enforce any project rule without code. Example entry:
+    //   { "name": "no-focused-tests", "pattern": "\\b(describe|it)\\.only\\(",
+    //     "message": "focused test left in", "severity": "error",
+    //     "include": ["src/**"], "exclude": ["**/*.test.*"] }
+    customRules: [],
+    // Universal per-check severity override, keyed by the check's display name (as
+    // shown in the report). "error" fails the run, "warn" is advisory, "off"
+    // disables the check. Empty by default — every check uses its built-in
+    // severity. Examples: { "Merge Conflict": "warn", "ESLint": "error" }.
+    severity: {},
+    // Git / PR-diff heuristics (delta-aware). Merge Conflict is blocking by
+    // default; the rest are advisory — promote any of them with `severity`.
+    mergeConflict: { enabled: true },
+    leftoverDebug: { enabled: true },
+    lockfileDrift: { enabled: true },
+    largeFiles: { enabled: true, maxSizeKb: 500, allow: [] },
+    missingTests: { enabled: true },
+    todoFixme: { enabled: true, requireTicket: false },
+    migrationSafety: { enabled: true },
+    // Security (regex diff scans + sensitive-file guard). Secret scan / npm audit
+    // live under `security`.
+    diffSecurity: { enabled: true },
+    sensitiveFileGuard: { enabled: true },
+    workflowSecurity: { enabled: true }, // GitHub Actions: injection, unpinned actions
+    dockerfileSecurity: { enabled: true }, // Dockerfile: :latest, USER root, curl|bash, …
+    caseCollision: { enabled: true }, // files differing only by case
+    vulnScan: { enabled: false }, // cross-language dep vulns (osv-scanner, runner-dependency)
+    // Test-coverage presence. Opt-in: enable once your CI produces a coverage
+    // report (lcov/cobertura/jacoco/…); warns if none is found.
+    coverage: { enabled: false },
+    // PR metadata / dependency hygiene.
+    prSize: { enabled: true, maxFiles: 50, maxLines: 1000 },
+    commitlint: { enabled: true },
+    // Dependencies you want to forbid. Example: { "name": "moment", "message": "use date-fns" }.
+    bannedImports: [],
+    // License/copyright header on new source files. Opt-in — set enabled + pattern.
+    licenseHeader: { enabled: false, pattern: '', lines: 10 },
+    outdatedDeps: { enabled: true, ignore: [] },
+    // Per-language checks. Bundled (no client install): TypeScript, Python (Ruff),
+    // C++ (clang-format). Runner-dependency (need the tool on the runner, skip
+    // gracefully if absent): Swift, Kotlin, Go, Rust, C#, Ruby, PHP.
+    python: { enabled: true, typecheck: true },
+    cpp: { enabled: true },
+    swift: { enabled: true },
+    kotlin: { enabled: true },
+    go: { enabled: true },
+    rust: { enabled: true },
+    csharp: { enabled: true },
+    ruby: { enabled: true },
+    php: { enabled: true },
     documentation: config_1.documentation,
 };
 const MANUAL_ENTRY = 'Enter manually';
@@ -169,6 +232,25 @@ async function createConfig(root) {
         sourcePath,
         languages,
     };
+    // Omit config blocks for languages not present in the repo — a cleaner,
+    // tailored file. This does NOT disable them: the key is simply absent, which
+    // still defaults to enabled, and runtime language detection gates whether each
+    // check runs. So a language added later auto-activates without editing config.
+    const LANGUAGE_TOGGLE_KEYS = [
+        'python',
+        'cpp',
+        'swift',
+        'kotlin',
+        'go',
+        'rust',
+        'csharp',
+        'ruby',
+        'php',
+    ];
+    for (const key of LANGUAGE_TOGGLE_KEYS) {
+        if (!languages.includes(key))
+            delete config[key];
+    }
     fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
     utils_1.logger.info(`[init]: ✅ Created pr-checkmate.json with sourcePath: ${sourcePath}`);
     utils_1.logger.info(`[init]: 💡 You can now customize ESLint rules, Prettier settings,

package/dist/interfaces/index.d.ts

@@ -24,6 +24,16 @@ export interface PRCheckMateConfig {
     sourcePath: string | string[];
     ignoreDirs?: string[];
     languages?: Language[];
+    customRules?: Array<{
+        name: string;
+        pattern: string;
+        message?: string;
+        severity?: 'error' | 'warn';
+        include?: string[];
+        exclude?: string[];
+        flags?: string;
+    }>;
+    severity?: Record<string, 'error' | 'warn' | 'off'>;
     lint?: {
         rules?: Record<string, any>;
         ignorePatterns?: string[];
@@ -39,6 +49,7 @@ export interface PRCheckMateConfig {
     security?: {
         gitleaks?: {
             enabled: boolean;
+            version?: string;
         };
         'npm-audit'?: {
             enabled: boolean;
@@ -60,10 +71,52 @@ export interface PRCheckMateConfig {
             lint?: boolean;
             format?: boolean;
         };
+        typecheck?: boolean;
+        typeChecker?: 'mypy' | 'pyright';
     };
     diffSmell?: {
         enabled?: boolean;
     };
+    prSize?: {
+        enabled?: boolean;
+        maxFiles?: number;
+        maxLines?: number;
+    };
+    leftoverDebug?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+    };
+    todoFixme?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        requireTicket?: boolean;
+        keywords?: string[];
+    };
+    lockfileDrift?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+    };
+    missingTests?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        ignore?: string[];
+    };
+    migrationSafety?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        paths?: string[];
+    };
+    coverage?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        reportPath?: string | string[];
+    };
+    largeFiles?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        maxSizeKb?: number;
+        allow?: string[];
+    };
     prBody?: {
         enabled?: boolean;
         minLength?: number;
@@ -101,6 +154,7 @@ export interface PRCheckMateConfig {
     };
     outdatedDeps?: {
         enabled?: boolean;
+        timeoutMs?: number;
         /**
          * Exact package names to exclude from the outdated-deps warning, e.g.
          * "commander". Use for dependencies deliberately pinned behind their latest
@@ -122,6 +176,38 @@ export interface PRCheckMateConfig {
     };
     diffSecurity?: {
         enabled?: boolean;
+        ignore?: string[];
+    };
+    mergeConflict?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+    };
+    workflowSecurity?: {
+        enabled?: boolean;
+        ignore?: string[];
+    };
+    dockerfileSecurity?: {
+        enabled?: boolean;
+        ignore?: string[];
+    };
+    caseCollision?: {
+        enabled?: boolean;
+    };
+    configValidation?: {
+        enabled?: boolean;
+    };
+    vulnScan?: {
+        enabled?: boolean;
+    };
+    bannedImports?: Array<{
+        name: string;
+        message?: string;
+        severity?: 'error' | 'warn';
+    }>;
+    licenseHeader?: {
+        enabled?: boolean;
+        pattern?: string;
+        lines?: number;
     };
     sensitiveFileGuard?: {
         enabled?: boolean;
@@ -132,6 +218,21 @@ export interface PRCheckMateConfig {
     kotlin?: {
         enabled?: boolean;
     };
+    go?: {
+        enabled?: boolean;
+    };
+    rust?: {
+        enabled?: boolean;
+    };
+    csharp?: {
+        enabled?: boolean;
+    };
+    ruby?: {
+        enabled?: boolean;
+    };
+    php?: {
+        enabled?: boolean;
+    };
     deadCode?: {
         enabled?: boolean;
         /**