pr-checkmate 1.23.2 → 1.23.3

package/dist/config/constants.js

@@ -253,6 +253,7 @@ exports.KNOWN_CONFIG_KEYS = new Set([
     'outdatedDeps',
     'licenseCheck',
     'vulnScan',
+    'grypeScan',
     'bannedImports',
     // git-diff / PR
     'mergeConflict',

package/dist/config/loader.d.ts

@@ -3,4 +3,4 @@ import { PRCheckMateConfig } from '../interfaces';
  * Load project configuration from pr-checkmate.json
  * Falls back to defaults if not found
  */
-export declare function loadProjectConfig(): PRCheckMateConfig;
+export declare function loadProjectConfig(cwd?: string): PRCheckMateConfig;

package/dist/config/loader.js

@@ -12,9 +12,8 @@ const constants_1 = require("./constants");
  * Load project configuration from pr-checkmate.json
  * Falls back to defaults if not found
  */
-function loadProjectConfig() {
-    const projectRoot = process.cwd();
-    const configPath = node_path_1.default.join(projectRoot, 'pr-checkmate.json');
+function loadProjectConfig(cwd = process.cwd()) {
+    const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (node_fs_1.default.existsSync(configPath)) {
         try {
             const content = node_fs_1.default.readFileSync(configPath, 'utf-8');
@@ -33,6 +32,11 @@ function loadProjectConfig() {
 function mergeWithDefaults(userConfig) {
     const defaults = getDefaultConfig();
     return {
+        // Preserve every key the user set — including opt-in checks (vulnScan,
+        // grypeScan) and controls with no default entry below (severity, customRules,
+        // prSize, caseCollision, go/rust/ruby/php, …). The explicitly-merged keys
+        // that follow override this spread with their default-merged values.
+        ...userConfig,
         sourcePath: userConfig.sourcePath || defaults.sourcePath,
         // Replace (not merge): the client sees the full default list in their
         // generated config and edits it directly, so their list is authoritative.

package/dist/core/checks/dependencies/grype-scan.d.ts

@@ -0,0 +1,16 @@
+import { Check } from '../../types';
+/**
+ * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and opt-in
+ * (`grypeScan.enabled: true`): grype must be on the runner, and the check skips
+ * gracefully when it is absent.
+ *
+ * grype resolves versions from lockfiles, so its raw output includes the entire
+ * transitive tree — and, because pr-checkmate installs into the consumer's
+ * node_modules, its own bundled dependencies too. Neither is something the
+ * consumer can fix. We therefore report ONLY vulnerabilities in DIRECT
+ * dependencies (those declared in the project's manifests, see
+ * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
+ * ecosystem has no manifest we can parse are suppressed too, and the count of
+ * everything dropped is logged so nothing is hidden silently.
+ */
+export declare const grypeScanCheck: Check;

package/dist/core/checks/dependencies/grype-scan.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grypeScanCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
+/** grype artifact `type` → the ecosystem we can resolve direct deps for. */
+const TYPE_TO_ECOSYSTEM = {
+    npm: 'npm',
+    python: 'python',
+    'go-module': 'go',
+    'rust-crate': 'rust',
+    gem: 'ruby',
+    'php-composer': 'php',
+};
+function severityRank(severity) {
+    return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
+}
+/**
+ * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and opt-in
+ * (`grypeScan.enabled: true`): grype must be on the runner, and the check skips
+ * gracefully when it is absent.
+ *
+ * grype resolves versions from lockfiles, so its raw output includes the entire
+ * transitive tree — and, because pr-checkmate installs into the consumer's
+ * node_modules, its own bundled dependencies too. Neither is something the
+ * consumer can fix. We therefore report ONLY vulnerabilities in DIRECT
+ * dependencies (those declared in the project's manifests, see
+ * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
+ * ecosystem has no manifest we can parse are suppressed too, and the count of
+ * everything dropped is logged so nothing is hidden silently.
+ */
+exports.grypeScanCheck = {
+    name: 'Grype Scan',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.grypeScan?.enabled === true;
+    },
+    async run(ctx) {
+        const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
+        const minRank = severityRank(minSeverity);
+        const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
+        const result = await (0, execa_1.execa)('grype', ['dir:.', '-o', 'json', '-q'], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
+        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
+        // when the binary is absent — detect the missing scanner on the result.
+        if (result.code === 'ENOENT')
+            return (0, types_1.skip)('grype not installed');
+        let report;
+        try {
+            report = JSON.parse(result.stdout);
+        }
+        catch {
+            return (0, types_1.warn)('grype produced no parseable output');
+        }
+        const matches = report.matches ?? [];
+        const direct = (0, utils_1.collectDirectDeps)(ctx.cwd);
+        // Keep only: severity >= threshold, a direct dependency, and not ignored.
+        const isDirect = (m) => {
+            const ecosystem = TYPE_TO_ECOSYSTEM[m.artifact?.type ?? ''];
+            const names = ecosystem && direct.get(ecosystem);
+            if (!names)
+                return false; // unknown/unparseable ecosystem → not our concern
+            return names.has((0, utils_1.normalizeName)(ecosystem, m.artifact?.name ?? ''));
+        };
+        const isIgnored = (m) => ignore.includes((m.vulnerability?.id ?? '').toLowerCase()) ||
+            ignore.includes((m.artifact?.name ?? '').toLowerCase());
+        const atSeverity = matches.filter(m => severityRank(m.vulnerability?.severity) >= minRank);
+        const findings = atSeverity.filter(m => isDirect(m) && !isIgnored(m));
+        const suppressed = atSeverity.length - findings.length;
+        if (suppressed > 0) {
+            utils_1.logger.info(`[Grype Scan]: suppressed ${suppressed} finding(s) — transitive/third-party (not directly fixable) or ignored`);
+        }
+        if (findings.length === 0) {
+            utils_1.logger.info('[Grype Scan]: ✅ No known vulnerabilities in direct dependencies');
+            return (0, types_1.pass)();
+        }
+        utils_1.logger.warn(`[Grype Scan]: ⚠️ vulnerabilities in direct dependencies (>= ${minSeverity}):`);
+        findings
+            .slice(0, 10)
+            .forEach(m => utils_1.logger.warn(`  ${m.vulnerability?.id ?? 'unknown'} — ${m.artifact?.name ?? '?'}@${m.artifact?.version ?? '?'} (${m.vulnerability?.severity ?? '?'})`));
+        if (findings.length > 10)
+            utils_1.logger.warn(`  ... and ${findings.length - 10} more`);
+        return (0, types_1.warn)(`${findings.length} direct-dependency vulnerability(ies) at "${minSeverity}"+ (grype)`);
+    },
+};

package/dist/core/registry.js

@@ -4,6 +4,7 @@ exports.REGISTRY = void 0;
 const banned_imports_1 = require("./checks/dependencies/banned-imports");
 const circular_deps_1 = require("./checks/dependencies/circular-deps");
 const dependency_check_1 = require("./checks/dependencies/dependency-check");
+const grype_scan_1 = require("./checks/dependencies/grype-scan");
 const license_check_1 = require("./checks/dependencies/license-check");
 const npm_audit_1 = require("./checks/dependencies/npm-audit");
 const outdated_deps_1 = require("./checks/dependencies/outdated-deps");
@@ -71,6 +72,7 @@ exports.REGISTRY = [
     dockerfile_security_1.dockerfileSecurityCheck,
     case_collision_1.caseCollisionCheck,
     vuln_scan_1.vulnScanCheck,
+    grype_scan_1.grypeScanCheck,
     custom_rules_1.customRulesCheck,
     banned_imports_1.bannedImportsCheck,
     license_header_1.licenseHeaderCheck,

package/dist/init.js

@@ -134,6 +134,7 @@ const DEFAULT_CONFIG = {
     dockerfileSecurity: { enabled: true }, // Dockerfile: :latest, USER root, curl|bash, …
     caseCollision: { enabled: true }, // files differing only by case
     vulnScan: { enabled: false }, // cross-language dep vulns (osv-scanner, runner-dependency)
+    grypeScan: { enabled: false, minSeverity: 'medium' }, // dep vulns (grype, non-blocking, runner-dependency)
     // Test-coverage presence. Opt-in: enable once your CI produces a coverage
     // report (lcov/cobertura/jacoco/…); warns if none is found.
     coverage: { enabled: false },

package/dist/interfaces/index.d.ts

@@ -199,6 +199,11 @@ export interface PRCheckMateConfig {
     vulnScan?: {
         enabled?: boolean;
     };
+    grypeScan?: {
+        enabled?: boolean;
+        minSeverity?: 'negligible' | 'low' | 'medium' | 'high' | 'critical';
+        ignore?: string[];
+    };
     bannedImports?: Array<{
         name: string;
         message?: string;

package/dist/utils/direct-deps.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Package ecosystems for which we can determine a project's DIRECT (declared)
+ * dependencies from a manifest — the set a maintainer actually controls and can
+ * bump. Transitive packages (resolved only in a lockfile) are deliberately not
+ * here: the consumer cannot fix them directly, so a vuln scan must not flag them.
+ */
+export type Ecosystem = 'npm' | 'python' | 'go' | 'rust' | 'ruby' | 'php';
+/** Canonical key for name comparison within an ecosystem. */
+export declare function normalizeName(ecosystem: Ecosystem, name: string): string;
+/**
+ * Build the set of DIRECT (declared) dependency names for `cwd`, keyed by
+ * ecosystem, by parsing manifests — not lockfiles. Used to filter vulnerability
+ * scanner output down to what the consumer actually controls: transitive
+ * dependencies (present only in lockfiles) and the scanning tool's own bundled
+ * dependencies are absent from these manifests and thus never reported.
+ *
+ * Dependency-free and best-effort: unparseable/absent manifests contribute
+ * nothing rather than throwing. An ecosystem with no manifest yields no entry
+ * (callers should treat "no entry" as "cannot classify" — see grype-scan).
+ */
+export declare function collectDirectDeps(cwd: string): Map<Ecosystem, Set<string>>;

package/dist/utils/direct-deps.js

@@ -0,0 +1,225 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeName = normalizeName;
+exports.collectDirectDeps = collectDirectDeps;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/** Directories never worth descending into when locating manifests. */
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'vendor',
+    '.venv',
+    'venv',
+    'target',
+]);
+/** PEP 503 normalisation, applied to both manifest and scanner names for Python. */
+function normalizePython(name) {
+    return name
+        .trim()
+        .toLowerCase()
+        .replace(/[-_.]+/g, '-');
+}
+/** Canonical key for name comparison within an ecosystem. */
+function normalizeName(ecosystem, name) {
+    return ecosystem === 'python' ? normalizePython(name) : name.trim().toLowerCase();
+}
+function readJson(file) {
+    try {
+        return JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function readText(file) {
+    try {
+        return node_fs_1.default.readFileSync(file, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Collect direct dep names from a package.json's four dependency maps. */
+function addNpm(file, out) {
+    const pkg = readJson(file);
+    if (!pkg)
+        return;
+    for (const key of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies',
+    ]) {
+        const map = pkg[key];
+        if (map && typeof map === 'object') {
+            for (const name of Object.keys(map))
+                out.add(normalizeName('npm', name));
+        }
+    }
+}
+/** Extract the bare package name from a Python requirement specifier line. */
+function pythonReqName(line) {
+    const stripped = line.split('#')[0].trim();
+    if (!stripped || stripped.startsWith('-'))
+        return null; // skip options like -r / -e
+    const match = /^([A-Za-z0-9._-]+)/.exec(stripped);
+    return match ? normalizePython(match[1]) : null;
+}
+function addPython(cwd, out, manifests) {
+    for (const file of manifests) {
+        const base = node_path_1.default.basename(file);
+        if (base.startsWith('requirements') && base.endsWith('.txt')) {
+            const text = readText(file);
+            if (text)
+                text.split('\n').forEach(l => {
+                    const n = pythonReqName(l);
+                    if (n)
+                        out.add(n);
+                });
+        }
+        else if (base === 'pyproject.toml' || base === 'Pipfile') {
+            const text = readText(file);
+            if (!text)
+                continue;
+            // Best-effort, parser-free: PEP 621 `dependencies = ["pkg>=1", ...]`,
+            // Poetry/Pipfile `pkg = "^1.2"` table entries. Section-agnostic on purpose.
+            for (const m of text.matchAll(/["']([A-Za-z0-9._-]+)\s*(?:[<>=!~;)\[]|["'])/g)) {
+                const n = normalizePython(m[1]);
+                if (n && n !== 'python')
+                    out.add(n);
+            }
+            for (const m of text.matchAll(/^\s*([A-Za-z0-9._-]+)\s*=/gm)) {
+                const n = normalizePython(m[1]);
+                if (n && n !== 'python')
+                    out.add(n);
+            }
+        }
+    }
+}
+function addGo(file, out) {
+    const text = readText(file);
+    if (!text)
+        return;
+    // `require ( ... )` block and single-line `require x v...`; skip `// indirect`.
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (line.includes('// indirect'))
+            continue;
+        const m = /^(?:require\s+)?([a-zA-Z0-9._~/-]+\.[a-zA-Z0-9._~/-]+)\s+v/.exec(line);
+        if (m)
+            out.add(m[1].toLowerCase());
+    }
+}
+function addRust(file, out) {
+    const text = readText(file);
+    if (!text)
+        return;
+    // Keys under [dependencies] / [dev-dependencies] / [build-dependencies].
+    let inDeps = false;
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (line.startsWith('[')) {
+            inDeps = /^\[(?:.*\.)?(?:dev-|build-)?dependencies\]$/.test(line);
+            continue;
+        }
+        if (!inDeps)
+            continue;
+        const m = /^([A-Za-z0-9._-]+)\s*=/.exec(line);
+        if (m)
+            out.add(m[1].toLowerCase());
+    }
+}
+function addRuby(file, out) {
+    const text = readText(file);
+    if (!text)
+        return;
+    for (const m of text.matchAll(/^\s*gem\s+["']([A-Za-z0-9._-]+)["']/gm)) {
+        out.add(m[1].toLowerCase());
+    }
+}
+function addPhp(file, out) {
+    const pkg = readJson(file);
+    if (!pkg)
+        return;
+    for (const key of ['require', 'require-dev']) {
+        const map = pkg[key];
+        if (map && typeof map === 'object') {
+            for (const name of Object.keys(map)) {
+                if (name === 'php' || name.startsWith('ext-'))
+                    continue;
+                out.add(name.toLowerCase());
+            }
+        }
+    }
+}
+/** Recursively list files matching any of `names`, skipping vendored dirs. */
+function findManifests(cwd, names, matchPrefix) {
+    const found = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = node_fs_1.default.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
+                    walk(node_path_1.default.join(dir, entry.name));
+                }
+            }
+            else if (names.has(entry.name) || (matchPrefix && matchPrefix.test(entry.name))) {
+                found.push(node_path_1.default.join(dir, entry.name));
+            }
+        }
+    };
+    walk(cwd);
+    return found;
+}
+/**
+ * Build the set of DIRECT (declared) dependency names for `cwd`, keyed by
+ * ecosystem, by parsing manifests — not lockfiles. Used to filter vulnerability
+ * scanner output down to what the consumer actually controls: transitive
+ * dependencies (present only in lockfiles) and the scanning tool's own bundled
+ * dependencies are absent from these manifests and thus never reported.
+ *
+ * Dependency-free and best-effort: unparseable/absent manifests contribute
+ * nothing rather than throwing. An ecosystem with no manifest yields no entry
+ * (callers should treat "no entry" as "cannot classify" — see grype-scan).
+ */
+function collectDirectDeps(cwd) {
+    const result = new Map();
+    const npm = new Set();
+    findManifests(cwd, new Set(['package.json'])).forEach(f => addNpm(f, npm));
+    if (npm.size)
+        result.set('npm', npm);
+    const python = new Set();
+    const pyManifests = findManifests(cwd, new Set(['pyproject.toml', 'Pipfile']), /^requirements.*\.txt$/);
+    addPython(cwd, python, pyManifests);
+    if (python.size)
+        result.set('python', python);
+    const go = new Set();
+    findManifests(cwd, new Set(['go.mod'])).forEach(f => addGo(f, go));
+    if (go.size)
+        result.set('go', go);
+    const rust = new Set();
+    findManifests(cwd, new Set(['Cargo.toml'])).forEach(f => addRust(f, rust));
+    if (rust.size)
+        result.set('rust', rust);
+    const ruby = new Set();
+    findManifests(cwd, new Set(['Gemfile'])).forEach(f => addRuby(f, ruby));
+    if (ruby.size)
+        result.set('ruby', ruby);
+    const php = new Set();
+    findManifests(cwd, new Set(['composer.json'])).forEach(f => addPhp(f, php));
+    if (php.size)
+        result.set('php', php);
+    return result;
+}

package/dist/utils/index.d.ts

@@ -2,6 +2,7 @@ export * from './logger';
 export * from './result-collector';
 export * from './resolve-bin';
 export * from './own-deps';
+export * from './direct-deps';
 export * from './detect-language';
 export * from './glob';
 export * from './update-notifier';

package/dist/utils/index.js

@@ -24,6 +24,7 @@ __exportStar(require("./logger"), exports);
 __exportStar(require("./result-collector"), exports);
 __exportStar(require("./resolve-bin"), exports);
 __exportStar(require("./own-deps"), exports);
+__exportStar(require("./direct-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 __exportStar(require("./glob"), exports);
 __exportStar(require("./update-notifier"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.2",
+    "version": "1.23.3",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -41,7 +41,7 @@
     ],
     "scripts": {
         "copy-configs": "ts-node src/scripts/copy-configs.ts",
-        "build": "npm run clean && npm run copy-configs && tsc && npm run fix-shebang",
+        "build": "npm run clean && npm run copy-configs && tsc -p tsconfig.build.json && npm run fix-shebang",
         "fix-shebang": "node -e \"const fs=require('fs'); const path='dist/cli.js'; let content=fs.readFileSync(path,'utf8'); if(!content.startsWith('#!')){content='#!/usr/bin/env node\\n'+content; fs.writeFileSync(path,content);} fs.chmodSync(path,'755');\"",
         "check": "npm run build && npm run lint && npm run prettier && npm run spellcheck",
         "prepublishOnly": "npm run build",
@@ -50,7 +50,7 @@
         "spellcheck": "cspell '**/*.{ts,tsx,js,jsx,md,json}' --no-progress",
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
-        "test": "echo 'Tests coming soon'",
+        "test": "node --require ts-node/register --test \"src/**/*.test.ts\"",
         "security-scan": "npx pr-checkmate security",
         "clean": "rm -rf dist",
         "release": "standard-version"

package/pr-checkmate.schema.json

@@ -89,6 +89,17 @@
       "type": "object",
       "properties": { "enabled": { "type": "boolean" } }
     },
+    "grypeScan": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "minSeverity": {
+          "type": "string",
+          "enum": ["negligible", "low", "medium", "high", "critical"]
+        },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    },
     "mergeConflict": { "$ref": "#/$defs/toggleSeverity" },
     "leftoverDebug": { "$ref": "#/$defs/toggleSeverity" },
     "lockfileDrift": { "$ref": "#/$defs/toggleSeverity" },