pr-checkmate 1.23.0 → 1.23.1

package/cspell.json

@@ -701,7 +701,22 @@
     "depcheckrc",
     "gofmt",
     "dotnet",
-    "rubocop"
+    "rubocop",
+    "precommit",
+    "swiftpm",
+    "recognises",
+    "vulnerab",
+    "numstat",
+    "bpprint",
+    "pprint",
+    "bpdb",
+    "setext",
+    "Confict",
+    "bhashlib",
+    "bfmt",
+    "dockerfiles",
+    "footguns",
+    "materialises"
   ],
   "ignorePaths": [
     "**/node_modules/**",

package/dist/cli.js

@@ -63,7 +63,15 @@ void (async () => {
         // Full run: auto-detect the CI platform (GitHub/GitLab/Bitbucket), post the
         // summary to its PR/MR, and allow formatters to write.
         if (!cmd || cmd === 'all') {
+            // Fetch the update notice concurrently (best-effort, never blocks/affects
+            // the exit code), but print it LAST — after the summary — so it's noticeable.
+            const noticePromise = (0, utils_1.getUpdateNotice)();
             const report = await (0, core_1.runChecks)({ reporter: 'auto', write: true });
+            const notice = await noticePromise.catch(() => null);
+            if (notice) {
+                utils_1.logger.info('');
+                notice.forEach(line => utils_1.logger.info(line));
+            }
             process.exit(report.ok ? 0 : 1);
         }
         // Local pre-commit: check the staged changes (index vs HEAD), print to

package/dist/core/checks/dependencies/outdated-deps.js

@@ -9,6 +9,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
+const DEFAULT_TIMEOUT_MS = 30000;
 exports.outdatedDepsCheck = {
     name: 'Outdated Deps',
     phase: 'informational',
@@ -18,8 +19,20 @@ exports.outdatedDepsCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
+        // `npm outdated` queries the registry for every dependency and can take a
+        // long time on big dependency trees — cap it so an advisory check never
+        // holds up CI. On timeout, skip rather than fail.
+        const timeout = ctx.config.outdatedDeps?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         // npm outdated exits 1 when outdated packages exist — use reject:false.
-        const result = await (0, execa_1.execa)('npm', ['outdated', '--json'], { cwd: ctx.cwd, reject: false });
+        const result = await (0, execa_1.execa)('npm', ['outdated', '--json'], {
+            cwd: ctx.cwd,
+            reject: false,
+            timeout,
+        });
+        if (result.timedOut) {
+            utils_1.logger.warn(`[Outdated Deps]: ⚠️ npm outdated timed out after ${timeout}ms — skipping`);
+            return (0, types_1.skip)('npm outdated timed out');
+        }
         if (!result.stdout?.trim())
             return (0, types_1.pass)();
         let outdated;

package/dist/core/checks/git/large-files.js

@@ -12,6 +12,29 @@ const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 const findings_1 = require("../findings");
 const DEFAULT_MAX_KB = 500;
+/**
+ * Lockfiles are legitimately large and always generated, never accidental — so
+ * they're exempt from the size/binary guard by default (a 600 KB
+ * package-lock.json is normal, not bloat). Their changes are still surfaced by
+ * the Lockfile Drift and Sensitive Files checks. Merged with the client's
+ * `largeFiles.allow`.
+ */
+const LOCKFILE_ALLOW = [
+    '**/package-lock.json',
+    '**/npm-shrinkwrap.json',
+    '**/yarn.lock',
+    '**/pnpm-lock.yaml',
+    '**/bun.lockb',
+    '**/Cargo.lock',
+    '**/poetry.lock',
+    '**/uv.lock',
+    '**/Pipfile.lock',
+    '**/pdm.lock',
+    '**/Gemfile.lock',
+    '**/composer.lock',
+    '**/go.sum',
+    '**/Package.resolved',
+];
 /**
  * Parse `git diff --numstat` and collect files git reports as binary — those
  * rows carry `-` in both the additions and deletions columns.
@@ -45,7 +68,7 @@ exports.largeFilesCheck = {
             return (0, types_1.pass)();
         const maxKb = ctx.config.largeFiles?.maxSizeKb ?? DEFAULT_MAX_KB;
         const maxBytes = maxKb * 1024;
-        const allow = ctx.config.largeFiles?.allow ?? [];
+        const allow = [...LOCKFILE_ALLOW, ...(ctx.config.largeFiles?.allow ?? [])];
         let binary;
         try {
             const { stdout } = await (0, execa_1.execa)('git', ['diff', '--numstat', '--diff-filter=ACM', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
@@ -57,7 +80,7 @@ exports.largeFilesCheck = {
         }
         const findings = [];
         for (const file of files) {
-            if (allow.length > 0 && (0, utils_1.matchesAnyGlob)(file, allow))
+            if ((0, utils_1.matchesAnyGlob)(file, allow))
                 continue;
             let size;
             try {

package/dist/core/checks/security/security.js

@@ -23,7 +23,12 @@ exports.securityCheck = {
             'gitleaks.toml',
             '.gitleaks/config.toml',
         ]);
-        const args = ['--diff-mode', 'ci'];
+        // Pin the gitleaks binary version so the scanner never reaches out to the
+        // GitHub API for the "latest" version — that network call adds latency and
+        // times out in locked-down/offline CI (the scanner already falls back to
+        // this exact version). Overridable via `security.gitleaks.version`.
+        const gitleaksVersion = ctx.config.security?.gitleaks?.version ?? '8.30.0';
+        const args = ['--diff-mode', 'ci', '--gitleaks-version', gitleaksVersion];
         if (!hasClientConfig) {
             args.push('--config', (0, config_1.getPackageConfigPath)('gitleaks.toml'));
         }

package/dist/core/reporters.js

@@ -69,6 +69,8 @@ function printStdout(report) {
     utils_1.logger.info(SUMMARY_RULE);
     utils_1.logger.info(`  ✅ ${passed} passed  ⚠️ ${warned} warnings  ❌ ${failed} failed  ⏭️ ${skipped} skipped`);
     utils_1.logger.info(SUMMARY_BORDER);
+    // Always shown under the report — the docs cover every check and config key.
+    utils_1.logger.info(' DOCUMENTATION: https://pr-checkmate-docs.pages.dev/');
 }
 async function upsertGithubComment(body) {
     const ctx = getPrContext();

package/dist/init.js

@@ -232,6 +232,25 @@ async function createConfig(root) {
         sourcePath,
         languages,
     };
+    // Omit config blocks for languages not present in the repo — a cleaner,
+    // tailored file. This does NOT disable them: the key is simply absent, which
+    // still defaults to enabled, and runtime language detection gates whether each
+    // check runs. So a language added later auto-activates without editing config.
+    const LANGUAGE_TOGGLE_KEYS = [
+        'python',
+        'cpp',
+        'swift',
+        'kotlin',
+        'go',
+        'rust',
+        'csharp',
+        'ruby',
+        'php',
+    ];
+    for (const key of LANGUAGE_TOGGLE_KEYS) {
+        if (!languages.includes(key))
+            delete config[key];
+    }
     fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
     utils_1.logger.info(`[init]: ✅ Created pr-checkmate.json with sourcePath: ${sourcePath}`);
     utils_1.logger.info(`[init]: 💡 You can now customize ESLint rules, Prettier settings,

package/dist/interfaces/index.d.ts

@@ -49,6 +49,7 @@ export interface PRCheckMateConfig {
     security?: {
         gitleaks?: {
             enabled: boolean;
+            version?: string;
         };
         'npm-audit'?: {
             enabled: boolean;
@@ -153,6 +154,7 @@ export interface PRCheckMateConfig {
     };
     outdatedDeps?: {
         enabled?: boolean;
+        timeoutMs?: number;
         /**
          * Exact package names to exclude from the outdated-deps warning, e.g.
          * "commander". Use for dependencies deliberately pinned behind their latest

package/dist/utils/index.d.ts

@@ -4,6 +4,7 @@ export * from './resolve-bin';
 export * from './own-deps';
 export * from './detect-language';
 export * from './glob';
+export * from './update-notifier';
 /**
  *
  */

package/dist/utils/index.js

@@ -26,6 +26,7 @@ __exportStar(require("./resolve-bin"), exports);
 __exportStar(require("./own-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 __exportStar(require("./glob"), exports);
+__exportStar(require("./update-notifier"), exports);
 /**
  *
  */

package/dist/utils/update-notifier.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Best-effort check for a newer published version. Returns the notice lines when
+ * an update exists, or `null` (up-to-date, offline, timed out, or opted out).
+ * Non-blocking and fully silent on any failure: short timeout, swallowed errors,
+ * opt-out via `PR_CHECKMATE_NO_UPDATE_CHECK`. Returns lines instead of logging so
+ * the caller can print them at the very end — after the summary — where they're
+ * noticeable. Deliberately called ONLY from the CLI (not `runChecks`) so
+ * programmatic consumers (e.g. a wrapping SDK) never trigger a network call.
+ */
+export declare function getUpdateNotice(timeoutMs?: number): Promise<string[] | null>;

package/dist/utils/update-notifier.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUpdateNotice = getUpdateNotice;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/** Compare dotted versions; true when `latest` is strictly greater than `current`. */
+function isNewer(latest, current) {
+    const a = latest.split('.').map(n => parseInt(n, 10) || 0);
+    const b = current.split('.').map(n => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        if ((a[i] ?? 0) !== (b[i] ?? 0))
+            return (a[i] ?? 0) > (b[i] ?? 0);
+    }
+    return false;
+}
+/**
+ * Best-effort check for a newer published version. Returns the notice lines when
+ * an update exists, or `null` (up-to-date, offline, timed out, or opted out).
+ * Non-blocking and fully silent on any failure: short timeout, swallowed errors,
+ * opt-out via `PR_CHECKMATE_NO_UPDATE_CHECK`. Returns lines instead of logging so
+ * the caller can print them at the very end — after the summary — where they're
+ * noticeable. Deliberately called ONLY from the CLI (not `runChecks`) so
+ * programmatic consumers (e.g. a wrapping SDK) never trigger a network call.
+ */
+async function getUpdateNotice(timeoutMs = 2500) {
+    if (process.env.PR_CHECKMATE_NO_UPDATE_CHECK)
+        return null;
+    try {
+        const pkgPath = node_path_1.default.resolve(__dirname, '../..', 'package.json');
+        const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgPath, 'utf-8'));
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let latest;
+        try {
+            const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(pkg.name)}/latest`, {
+                signal: controller.signal,
+            });
+            if (res.ok)
+                latest = (await res.json()).version;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (latest && isNewer(latest, pkg.version)) {
+            return [
+                `⬆️  A new version of ${pkg.name} is available: ${pkg.version} → ${latest}`,
+                `    Update:  npm install ${pkg.name}@latest`,
+                '    Details: https://www.npmjs.com/package/pr-checkmate',
+            ];
+        }
+        return null;
+    }
+    catch {
+        // Best-effort only — never let an update check slow or break a run.
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.0",
+    "version": "1.23.1",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",

package/src/config/cspell.json

@@ -701,7 +701,22 @@
     "depcheckrc",
     "gofmt",
     "dotnet",
-    "rubocop"
+    "rubocop",
+    "precommit",
+    "swiftpm",
+    "recognises",
+    "vulnerab",
+    "numstat",
+    "bpprint",
+    "pprint",
+    "bpdb",
+    "setext",
+    "Confict",
+    "bhashlib",
+    "bfmt",
+    "dockerfiles",
+    "footguns",
+    "materialises"
   ],
   "ignorePaths": [
     "**/node_modules/**",