pr-checkmate 1.23.19 → 1.23.21

package/dist/core/context.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.planDiffRange = planDiffRange;
 exports.buildContext = buildContext;
 const node_fs_1 = __importDefault(require("node:fs"));
 const loader_1 = require("../config/loader");
@@ -10,41 +11,71 @@ const utils_1 = require("../utils");
 const detect_language_1 = require("../utils/detect-language");
 const execa_1 = require("../utils/execa");
 /**
- * Resolve the diff range for delta-aware checks.
- * Prefers explicit opts, then GitHub PR event, then Bitbucket PR env, then git HEAD^.
- * Returns undefined SHAs when nothing usable is found → checks fall back to full scan.
+ * Decide what to look at. Order matters and is the contract:
+ *
+ * 1. `full` wins over everything — an explicit "check all of it" must not be
+ *    quietly narrowed by a CI variable that happens to be set.
+ * 2. `staged`, then caller-supplied SHAs.
+ * 3. The CI platform's PR context (GitHub event payload, Bitbucket destination
+ *    branch) — a gate exists to judge the diff.
+ * 4. A CI build with no PR context still diffs `HEAD^`: it is a push/branch build,
+ *    and delta is why CI runs are fast.
+ * 5. Anything else is a human at a terminal → full scan. `HEAD^` used to be the
+ *    fallback here, which meant a local `pr-checkmate all` judged only the last
+ *    commit and could report a clean project with a `debugger` committed earlier.
+ *
+ * @param opts Run options as passed to `runChecks`.
+ * @param env Environment to read CI markers from. Defaults to the current process.
  */
+function planDiffRange(opts, env = process.env) {
+    if (opts.full)
+        return { kind: 'full', reason: 'requested' };
+    if (opts.staged)
+        return { kind: 'staged' };
+    if (opts.baseSha || opts.headSha) {
+        return { kind: 'explicit', baseSha: opts.baseSha, headSha: opts.headSha };
+    }
+    if (env.GITHUB_EVENT_NAME === 'pull_request' && env.GITHUB_EVENT_PATH) {
+        return { kind: 'github-event' };
+    }
+    if (env.BITBUCKET_PR_DESTINATION_BRANCH) {
+        return {
+            kind: 'ref',
+            ref: `origin/${env.BITBUCKET_PR_DESTINATION_BRANCH}`,
+            reason: 'PR build',
+        };
+    }
+    if ((0, utils_1.isCiEnvironment)(env))
+        return { kind: 'ref', ref: 'HEAD^', reason: 'CI build, no PR context' };
+    return { kind: 'full', reason: 'no CI detected' };
+}
 /**
- * Resolve a git ref to a concrete commit SHA, or undefined when it can't be
- * resolved in this clone. `--verify --quiet` emits nothing (instead of echoing
- * the literal ref) and exits non-zero for a missing ref — e.g. `HEAD^` on a
- * single-commit repo, or a base branch not fetched in a shallow CI clone. That
- * way an unresolvable base yields `undefined` and callers fall back to a full
- * scan, rather than diffing against a garbage ref and silently checking nothing.
+ * Carry out a {@link RangePlan}. Every path that cannot produce a usable base
+ * commit returns no SHAs, which the checks read as "scan everything" — degrading
+ * to a full scan is always safer than diffing against a ref that isn't there and
+ * silently reviewing nothing.
+ *
+ * @returns The resolved range, plus a label for the log line.
  */
-async function resolveRef(cwd, ref) {
-    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
-        cwd,
-        reject: false,
-    });
-    return stdout.trim() || undefined;
-}
 async function resolveDiffRange(cwd, opts) {
+    const plan = planDiffRange(opts, process.env);
+    if (plan.kind === 'full')
+        return { scope: `full (${plan.reason})` };
     // Pre-commit mode: diff HEAD against the current index. `git write-tree`
     // materialises the staged index as a real tree object, so every check that
     // diffs baseSha..headSha sees exactly the staged changes — no per-check code.
-    if (opts.staged) {
+    if (plan.kind === 'staged') {
         try {
             const head = (await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
             const tree = (await (0, execa_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
-            return { baseSha: head, headSha: tree };
+            return { baseSha: head, headSha: tree, scope: 'staged' };
         }
         catch {
-            return {};
+            return { scope: 'full (no staged range)' };
         }
     }
-    if (opts.baseSha || opts.headSha) {
-        return { baseSha: opts.baseSha, headSha: opts.headSha };
+    if (plan.kind === 'explicit') {
+        return { baseSha: plan.baseSha, headSha: plan.headSha, scope: 'delta (explicit)' };
     }
     let headSha;
     try {
@@ -52,30 +83,32 @@ async function resolveDiffRange(cwd, opts) {
         headSha = stdout.trim();
     }
     catch {
-        return {};
+        return { scope: 'full (no HEAD)' };
     }
     // GitHub Actions: the PR event payload carries the base branch SHA. Read it
     // directly so delta works without relying on any client-set variable
     // (GITHUB_EVENT_* are injected by the runner).
-    if (process.env.GITHUB_EVENT_NAME === 'pull_request' && process.env.GITHUB_EVENT_PATH) {
+    if (plan.kind === 'github-event') {
         try {
             const event = JSON.parse(node_fs_1.default.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf-8'));
             const eventBase = event?.pull_request?.base?.sha;
             // Only use it if the commit is actually present in this clone; otherwise
             // fall through so a shallow clone degrades to a full scan, not 0 files.
-            const baseSha = eventBase ? await resolveRef(cwd, eventBase) : undefined;
+            const baseSha = eventBase ? await (0, utils_1.resolveGitRef)(cwd, eventBase) : undefined;
             if (baseSha)
-                return { baseSha, headSha };
+                return { baseSha, headSha, scope: 'delta (PR event)' };
         }
         catch {
-            // Malformed/unreadable event — fall through to the git-based resolution.
+            // Malformed/unreadable event — fall through to a full scan below.
         }
+        return { headSha, scope: 'full (PR base unavailable)' };
     }
-    // Bitbucket exposes the PR destination branch as an env var (also runner-set).
-    const bitbucketTarget = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
-    const ref = bitbucketTarget ? `origin/${bitbucketTarget}` : 'HEAD^';
-    const baseSha = await resolveRef(cwd, ref);
-    return { baseSha, headSha };
+    const baseSha = await (0, utils_1.resolveGitRef)(cwd, plan.ref);
+    return {
+        baseSha,
+        headSha,
+        scope: baseSha ? `delta (${plan.ref}, ${plan.reason})` : `full (${plan.ref} unresolvable)`,
+    };
 }
 /**
  * Assemble the shared CheckContext once per run. Language detection is skipped
@@ -84,9 +117,15 @@ async function resolveDiffRange(cwd, opts) {
 async function buildContext(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const config = opts.config ?? (0, loader_1.loadProjectConfig)();
-    const languages = opts.languages ?? (await (0, detect_language_1.detectLanguages)(cwd));
-    const { baseSha, headSha } = await resolveDiffRange(cwd, opts);
-    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false}`);
+    // Detection reads the client's `ignoreDirs` from the config already loaded here,
+    // rather than calling getIgnoredDirs() — that one resolves against process.cwd(),
+    // which is not necessarily the `cwd` under review.
+    const languages = opts.languages ?? (await (0, detect_language_1.detectLanguages)(cwd, config.ignoreDirs));
+    const { baseSha, headSha, scope } = await resolveDiffRange(cwd, opts);
+    // `scope` is logged because it decides what the whole run looks at, and getting
+    // it wrong is invisible in the results: a run that reviewed one commit and one
+    // that reviewed the repository both just print passes.
+    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false} scope=${scope}`);
     return {
         cwd,
         languages,

package/dist/core/targets.js

@@ -27,7 +27,7 @@ function excludeIgnoredDirs(files, keepDirs = []) {
         ignored.delete(dir);
     if (ignored.size === 0)
         return files;
-    return files.filter(f => !f.split('/').some(segment => ignored.has(segment)));
+    return files.filter(f => !(0, utils_1.isUnderIgnoredDir)(f, ignored));
 }
 /**
  * Lists the files a language check should operate on, matched by pathspec `globs`

package/dist/core/types.d.ts

@@ -90,6 +90,15 @@ export interface RunOptions {
      * (`git write-tree`), so every delta-aware check works unchanged.
      */
     staged?: boolean;
+    /**
+     * Review every tracked file instead of a diff (`--full` on the CLI, and the
+     * default when no CI environment is detected). Takes precedence over every other
+     * range source, including CI variables — see `planDiffRange`. The 16 checks that
+     * are about a diff by definition (PR Size, Diff Security, Merge Conflict, …) gate
+     * their own `applies` on `baseSha`, so they drop out of the report rather than
+     * misreporting.
+     */
+    full?: boolean;
 }
 export interface CheckReport {
     results: CheckResult[];

package/dist/init.js

@@ -11,20 +11,6 @@ const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("./config");
 const utils_1 = require("./utils");
 const CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
-/**
- * Load the canonical default ESLint rules (the same set eslint.config.mjs
- * applies) so the generated pr-checkmate.json lists every rule for the user to
- * change or disable. Falls back to an empty object if the file is unavailable.
- */
-function loadDefaultEslintRules() {
-    try {
-        return JSON.parse(fs_1.default.readFileSync((0, config_1.getPackageConfigPath)('eslint-default-rules.json'), 'utf-8'));
-    }
-    catch (err) {
-        utils_1.logger.warn(`[init]: ⚠️ Could not load default ESLint rules: ${err}`);
-        return {};
-    }
-}
 /**
  * Default configuration structure with customization options
  */
@@ -48,18 +34,36 @@ const DEFAULT_CONFIG = {
     // Directories excluded from every check (matched on any path segment). Edit
     // freely — add your own generated/vendored dirs or remove ones you want scanned.
     ignoreDirs: config_1.IGNORED_DIRS,
-    // ESLint — the full default rule set is written out so every rule is visible
-    // and editable. Change any value, or set a rule to "off" to disable it.
+    // ESLint — `rules` starts EMPTY on purpose and holds overrides only, each merged
+    // over the bundled default for that one rule.
+    //
+    // It used to be written out in full (all 27 rules with their severities) so every
+    // rule was visible and editable in this file. That copy then won over the bundled
+    // defaults forever: `eslint.rules` is in REPLACED_OBJECT_PATHS, so a later `init`
+    // keeps the user's block wholesale, and improvements to the defaults never reached
+    // a repo that had ever run `init`. Downgrading `prettier/prettier` from error to
+    // warn — so formatting stops failing pipelines — is exactly such an improvement,
+    // and it stopped at the config boundary for every existing client.
+    //
+    // The full list with defaults lives in the ESLint check documentation and in the
+    // package's own eslint-default-rules.json; discoverability there costs nothing,
+    // un-updatable defaults cost every client an edit.
     eslint: {
-        rules: loadDefaultEslintRules(),
+        rules: {},
         ignorePatterns: [],
     },
     // Prettier customization
     prettier: {
         rules: {},
     },
-    // Cspell customization
+    // Spellcheck (cspell). `enabled: false` turns the check off — that part always
+    // applies. The lists feed the cspell config pr-checkmate generates, so they are
+    // ignored when the repo has a cspell.json of its own; all of them are appended to
+    // the bundled defaults. `ignorePaths` takes globs to skip (e.g. "CHANGELOG.md",
+    // "generated/**"), anchored to the repo root so a pattern never matches a
+    // directory above the checkout.
     cspell: {
+        enabled: true,
         words: [],
         ignorePaths: [],
         ignoreRegExpList: [],

package/dist/interfaces/index.d.ts

@@ -19,6 +19,8 @@ export interface CspellConfig {
     ignorePaths: string[];
     enableFiletypes: string[];
     ignoreRegExpList: string[];
+    dictionaries?: string[];
+    enabled?: boolean;
 }
 export interface PRCheckMateConfig {
     sourcePath: string | string[];
@@ -42,14 +44,24 @@ export interface PRCheckMateConfig {
         config?: Record<string, any>;
     };
     spellcheck?: {
+        enabled?: boolean;
         words?: string[];
         ignoreWords?: string[];
         ignorePaths?: string[];
     };
+    cspell?: {
+        enabled?: boolean;
+        words?: string[];
+        ignorePaths?: string[];
+        ignoreRegExpList?: string[];
+        dictionaries?: string[];
+        language?: string;
+    };
     security?: {
         gitleaks?: {
             enabled?: boolean;
             version?: string;
+            depth?: number;
         };
         'npm-audit'?: {
             enabled?: boolean;

package/dist/utils/ci.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;

package/dist/utils/ci.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCiEnvironment = isCiEnvironment;
+/**
+ * Environment variables that mean "this is an automated build". `CI` alone covers
+ * GitHub Actions, GitLab, Bitbucket, CircleCI, Buildkite, Travis and most others;
+ * the rest are providers that either predate the convention or set only their own
+ * marker (Jenkins, TeamCity, Azure Pipelines, AWS CodeBuild).
+ *
+ * This answers a different question from `detectPlatform()` in reporters.ts, which
+ * picks WHERE to post a PR comment and therefore only knows the three platforms we
+ * can comment on. A Jenkins build is CI but has nowhere to post.
+ */
+const CI_ENV_VARS = [
+    'CI',
+    'GITHUB_ACTIONS',
+    'GITLAB_CI',
+    'BITBUCKET_BUILD_NUMBER',
+    'JENKINS_URL',
+    'TEAMCITY_VERSION',
+    'TF_BUILD',
+    'CIRCLECI',
+    'BUILDKITE',
+    'CODEBUILD_BUILD_ID',
+];
+/** Values that are present but mean "no" — some tooling exports `CI=false`. */
+const FALSY = new Set(['', '0', 'false', 'no', 'off']);
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+function isCiEnvironment(env = process.env) {
+    return CI_ENV_VARS.some(name => {
+        const value = env[name];
+        return value !== undefined && !FALSY.has(value.trim().toLowerCase());
+    });
+}

package/dist/utils/detect-language.d.ts

@@ -4,7 +4,12 @@ export type Language = 'typescript' | 'javascript' | 'python' | 'cpp' | 'swift'
  * with tracked source-file counts (breadth). A language is reported when it has a
  * marker file OR at least one tracked source file.
  *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
  * @returns languages ordered by tracked file count (most-used first). `.h` headers
  *   are intentionally excluded from the C++ count since they are ambiguous with C.
  */
-export declare function detectLanguages(root?: string): Promise<Language[]>;
+export declare function detectLanguages(root?: string, ignoreDirs?: string[]): Promise<Language[]>;

package/dist/utils/detect-language.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectLanguages = detectLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../config/constants");
 const execa_1 = require("./execa");
 const glob_1 = require("./glob");
 const logger_1 = require("./logger");
@@ -70,7 +71,7 @@ function hasMarker(root, lang) {
  * when git is unavailable or the directory is not a repo — callers then fall
  * back to marker files alone.
  */
-async function countTrackedFiles(root) {
+async function countTrackedFiles(root, ignoreDirs) {
     const counts = {
         typescript: 0,
         javascript: 0,
@@ -87,9 +88,18 @@ async function countTrackedFiles(root) {
     try {
         const { stdout } = await (0, execa_1.execa)('git', ['ls-files'], { cwd: root });
         const files = stdout.split('\n').map(f => f.trim());
+        const ignored = new Set(ignoreDirs);
         for (const file of files) {
             if (!file)
                 continue;
+            // A repository that commits its dependencies (`node_modules`, `vendor`,
+            // `third_party`) would otherwise be detected as a Python/Go/PHP project off
+            // the back of files nobody in it wrote, switching on whole toolchains for
+            // languages absent from the source. Detection has to describe the repo's own
+            // code, since it decides which checks run at all — the same exclusion every
+            // check's file list already applies via `excludeIgnoredDirs`.
+            if ((0, glob_1.isUnderIgnoredDir)(file, ignored))
+                continue;
             const ext = node_path_1.default.extname(file).toLowerCase();
             for (const lang of Object.keys(EXTENSIONS)) {
                 if (EXTENSIONS[lang].includes(ext)) {
@@ -109,11 +119,16 @@ async function countTrackedFiles(root) {
  * with tracked source-file counts (breadth). A language is reported when it has a
  * marker file OR at least one tracked source file.
  *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
  * @returns languages ordered by tracked file count (most-used first). `.h` headers
  *   are intentionally excluded from the C++ count since they are ambiguous with C.
  */
-async function detectLanguages(root = process.cwd()) {
-    const counts = await countTrackedFiles(root);
+async function detectLanguages(root = process.cwd(), ignoreDirs = constants_1.IGNORED_DIRS) {
+    const counts = await countTrackedFiles(root, ignoreDirs);
     const detected = Object.keys(EXTENSIONS).filter(lang => hasMarker(root, lang) || counts[lang] > 0);
     detected.sort((a, b) => counts[b] - counts[a]);
     const countStr = Object.keys(counts).map(l => `${l}=${counts[l]}`).join(', ');

package/dist/utils/git.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+export declare function resolveGitRef(cwd: string, ref: string): Promise<string | undefined>;

package/dist/utils/git.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGitRef = resolveGitRef;
+const execa_1 = require("./execa");
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+async function resolveGitRef(cwd, ref) {
+    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
+        cwd,
+        reject: false,
+    });
+    return stdout.trim() || undefined;
+}

package/dist/utils/glob.d.ts

@@ -8,3 +8,17 @@
 export declare function globToRegExp(glob: string): RegExp;
 /** True when `file` matches any of the glob `patterns`. */
 export declare function matchesAnyGlob(file: string, patterns: string[]): boolean;
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+export declare function isUnderIgnoredDir(file: string, ignoredDirs: Iterable<string>): boolean;

package/dist/utils/glob.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.globToRegExp = globToRegExp;
 exports.matchesAnyGlob = matchesAnyGlob;
+exports.isUnderIgnoredDir = isUnderIgnoredDir;
 /**
  * Minimal glob → RegExp for path matching against config patterns. Supports `*`
  * (matches within a path segment), `**` (across segments), and a leading `** /`
@@ -23,3 +24,22 @@ function globToRegExp(glob) {
 function matchesAnyGlob(file, patterns) {
     return patterns.some(p => globToRegExp(p).test(file));
 }
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+function isUnderIgnoredDir(file, ignoredDirs) {
+    const ignored = ignoredDirs instanceof Set ? ignoredDirs : new Set(ignoredDirs);
+    if (ignored.size === 0)
+        return false;
+    return file.split('/').some(segment => ignored.has(segment));
+}

package/dist/utils/index.d.ts

@@ -6,6 +6,8 @@ export * from './direct-deps';
 export * from './detect-language';
 export * from './glob';
 export * from './update-notifier';
+export * from './ci';
+export * from './git';
 /**
  *
  */

package/dist/utils/index.js

@@ -28,6 +28,8 @@ __exportStar(require("./direct-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 __exportStar(require("./glob"), exports);
 __exportStar(require("./update-notifier"), exports);
+__exportStar(require("./ci"), exports);
+__exportStar(require("./git"), exports);
 /**
  *
  */

package/eslint-default-rules.json

@@ -13,13 +13,13 @@
   "space-before-function-paren": "off",
   "operator-linebreak": "off",
   "max-len": ["warn", { "code": 100 }],
-  "semi": ["error", "always"],
-  "quotes": ["error", "single", { "avoidEscape": true }],
-  "object-curly-spacing": ["error", "always"],
-  "space-infix-ops": "error",
-  "keyword-spacing": ["error", { "before": true, "after": true }],
+  "semi": ["warn", "always"],
+  "quotes": ["warn", "single", { "avoidEscape": true }],
+  "object-curly-spacing": ["warn", "always"],
+  "space-infix-ops": "warn",
+  "keyword-spacing": ["warn", { "before": true, "after": true }],
   "padding-line-between-statements": [
-    "error",
+    "warn",
     { "blankLine": "always", "prev": "block", "next": "*" },
     { "blankLine": "always", "prev": "*", "next": "return" }
   ],
@@ -50,7 +50,7 @@
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",
   "prettier/prettier": [
-    "error",
+    "warn",
     {
       "semi": true,
       "singleQuote": true,

package/eslint.config.mjs

@@ -12,6 +12,22 @@ import jsdocPlugin from 'eslint-plugin-jsdoc';
  * Default ESLint rules — single source of truth, shared with init.ts so the
  * pr-checkmate.json it generates lists exactly the rules applied here. Edit the
  * rules in `eslint-default-rules.json` (shipped alongside this file).
+ *
+ * SEVERITY POLICY: `error` is reserved for defects a human has to resolve —
+ * `no-debugger`, `eqeqeq`, `prefer-const`, `@typescript-eslint/no-unused-vars`,
+ * `@typescript-eslint/no-floating-promises`, `import/no-duplicates`. Everything
+ * that is purely formatting is `warn`, even
+ * though it is auto-fixable, precisely BECAUSE it is auto-fixable: ESLint exits 1
+ * on errors only, and the ESLint check maps exit 1 to a blocking failure, so an
+ * `error`-level whitespace rule turns `npx prettier --write` worth of work into a
+ * red gate on someone's PR. Formatting still gets reported — as a warning here and
+ * by the dedicated Prettier check, which has always been advisory. A repo that
+ * wants formatting to gate promotes it back with
+ * `eslint.rules: { "prettier/prettier": "error" }` or
+ * `severity: { "Prettier": "error" }` in pr-checkmate.json.
+ *
+ * A JSON file cannot carry this note, hence it lives here; `src/config/.eslintrc.js`
+ * holds the same rule set for the legacy ESLint <9 path and must stay in sync.
  */
 const require = createRequire(import.meta.url);
 export const defaultRules = require('./eslint-default-rules.json');
@@ -34,7 +50,7 @@ const defaultIgnores = [
 function loadUserConfig() {
   let currentDir = process.cwd();
   let configPath = path.join(currentDir, 'pr-checkmate.json');
-  
+
   // If running from node_modules, find project root
   if (currentDir.includes('node_modules')) {
     const parts = currentDir.split(path.sep);
@@ -44,7 +60,7 @@ function loadUserConfig() {
       configPath = path.join(currentDir, 'pr-checkmate.json');
     }
   }
-  
+
   if (fs.existsSync(configPath)) {
     try {
       const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
@@ -56,7 +72,7 @@ function loadUserConfig() {
   } else {
     console.error(`[loadUserConfig]: No pr-checkmate.json found, using defaults`);
   }
-  
+
   return { sourcePath: 'src', eslint: {} };
 }
 
@@ -117,4 +133,4 @@ export default [
 
     rules: mergedRules,
   },
-];
+];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.19",
+    "version": "1.23.21",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -51,6 +51,7 @@
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
         "test": "node --require ts-node/register --test \"src/**/*.test.ts\"",
+        "verify:tarball": "bash scripts/verify-tarball.sh",
         "security-scan": "npx pr-checkmate security",
         "clean": "rm -rf dist",
         "release": "standard-version"