pr-checkmate 1.23.20 → 1.23.21

package/.eslintrc.js

@@ -70,13 +70,15 @@ module.exports = {
     'space-before-function-paren': 'off',
     'operator-linebreak': 'off',
     'max-len': ['warn', { code: 100 }],
-    semi: ['error', 'always'],
-    quotes: ['error', 'single', { avoidEscape: true }],
-    'object-curly-spacing': ['error', 'always'],
-    'space-infix-ops': 'error',
-    'keyword-spacing': ['error', { before: true, after: true }],
+    // Formatting is advisory — see the note above `rules` in eslint-flat-config.mjs.
+    // Keep these in sync with src/config/eslint-default-rules.json.
+    semi: ['warn', 'always'],
+    quotes: ['warn', 'single', { avoidEscape: true }],
+    'object-curly-spacing': ['warn', 'always'],
+    'space-infix-ops': 'warn',
+    'keyword-spacing': ['warn', { before: true, after: true }],
     'padding-line-between-statements': [
-      'error',
+      'warn',
       { blankLine: 'always', prev: 'block', next: '*' },
       { blankLine: 'always', prev: '*', next: 'return' },
     ],
@@ -108,7 +110,7 @@ module.exports = {
     'jsdoc/check-tag-names': 'warn',
     'jsdoc/check-types': 'warn',
     'prettier/prettier': [
-      'error',
+      'warn',
       {
         semi: true,
         singleQuote: true,

package/README.md

@@ -29,8 +29,8 @@ every PR.
 - One package, any stack. Language is auto-detected from the repo.
 - Bundled tooling. ESLint, Prettier, Ruff, clang-format, and gitleaks run inside the
   package (WASM/JS), so clients install nothing for those languages.
-- Delta mode. In a PR only the changed files are checked; a full-project scan is the
-  fallback outside PR context.
+- Delta mode. A PR run checks only the changed files; outside CI the default is every tracked
+  file. `--full` forces that anywhere, and a run that cannot resolve its base falls back to it.
 - Parallel phases. Checks run concurrently within each phase: blocking, then
   informational, then format.
 - Reports in the PR. Results post as a single comment that updates in place, and
@@ -79,6 +79,24 @@ Run all checks:
 npx pr-checkmate all
 ```
 
+Scope depends on where the command runs. In CI it reviews the pull request diff, taking the
+base SHA from the GitHub `pull_request` event or Bitbucket's destination branch; a CI build
+with no PR attached falls back to `HEAD^`. Locally, with no CI environment detected, it
+reviews every tracked file. It used to fall back to `HEAD^` there too, so a local run saw
+only the last commit and would report a clean project with a `debugger` committed the day
+before. `--full` forces the whole-repo review anywhere, including inside a CI build, and it
+composes with any command:
+
+```bash
+npx pr-checkmate all --full
+npx pr-checkmate lint --full
+```
+
+The 16 checks that only make sense on a diff (PR Size, Diff Security, Merge Conflict, Custom
+Rules, Banned Imports, the git-diff family) drop out of the report on a full scan. The
+[per-check reference](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/checks/INDEX.md)
+spells out the rules under "Review scope".
+
 ### Running in CI without installing
 
 Plenty of repos never add pr-checkmate to `package.json` and call it on the fly in CI

package/cspell.json

@@ -903,6 +903,7 @@
     "riskfolio",
     "robolectric",
     "rowwise",
+    "rseidelsohn",
     "Rshum",
     "rtol",
     "rtype",
@@ -1010,6 +1011,7 @@
     "taxinfo",
     "Tayebeh",
     "tcwf",
+    "teamcity",
     "telaviv",
     "temurin",
     "Tenés",

package/dist/cli.js

@@ -56,8 +56,51 @@ const COMMAND_TO_CHECK = {
 };
 /** Commands that run the whole pipeline (or no pipeline at all) and take no siblings. */
 const STANDALONE_COMMANDS = ['init', 'all', 'precommit'];
-const args = process.argv.slice(2);
+/** Flags accepted anywhere on the command line, with what each one means. */
+const FLAGS = {
+    '--full': 'review every tracked file instead of the diff (the default outside CI)',
+};
+const argv = process.argv.slice(2);
+/**
+ * Flags are separated from positional arguments so they compose with every command
+ * — scope is orthogonal to which checks run, hence `pr-checkmate lint --full` as
+ * well as `pr-checkmate all --full`.
+ */
+const flags = argv.filter(arg => arg.startsWith('-'));
+const args = argv.filter(arg => !arg.startsWith('-'));
 const cmd = args[0];
+/**
+ * An unrecognised flag aborts the run. Ignoring it would report success for a scope
+ * the user did not ask for: a misspelling of `--full` must not quietly review the
+ * diff and print a green summary.
+ */
+function rejectUnknownFlags() {
+    const unknown = flags.filter(flag => !FLAGS[flag]);
+    if (unknown.length === 0)
+        return;
+    const known = Object.entries(FLAGS)
+        .map(([flag, help]) => `${flag} (${help})`)
+        .join(', ');
+    utils_1.logger.error(`[cli]: Unknown flag(s) "${unknown.join('", "')}". Available: ${known}`);
+    process.exit(1);
+}
+/**
+ * `--full` and `precommit` ask for different things — every tracked file versus the
+ * staged changes only. `planDiffRange` resolves the conflict in favour of `--full`,
+ * which would silently turn a pre-commit hook into a whole-repo scan, so the
+ * contradiction is refused here instead.
+ */
+function rejectConflictingScope() {
+    if (cmd === 'precommit' && flags.includes('--full')) {
+        utils_1.logger.error('[cli]: "precommit --full" is contradictory — precommit reviews the staged changes. Run "pr-checkmate all --full" for a whole-repo review.');
+        process.exit(1);
+    }
+    if (cmd === 'init' && flags.length > 0) {
+        utils_1.logger.error(`[cli]: "init" takes no flags, got: ${flags.join(', ')}.`);
+        process.exit(1);
+    }
+}
+const full = flags.includes('--full');
 /**
  * Reject extra arguments after a standalone command. Silently ignoring them would
  * report success for work that never ran — `pr-checkmate init lint` must not look
@@ -75,6 +118,8 @@ function rejectExtraArgs() {
 }
 void (async () => {
     try {
+        rejectUnknownFlags();
+        rejectConflictingScope();
         rejectExtraArgs();
         if (cmd === 'init') {
             await (0, init_1.init)();
@@ -86,7 +131,7 @@ void (async () => {
             // Fetch the update notice concurrently (best-effort, never blocks/affects
             // the exit code), but print it LAST — after the summary — so it's noticeable.
             const noticePromise = (0, utils_1.getUpdateNotice)();
-            const report = await (0, core_1.runChecks)({ reporter: 'auto', write: true });
+            const report = await (0, core_1.runChecks)({ reporter: 'auto', write: true, full });
             const notice = await noticePromise.catch(() => null);
             if (notice) {
                 utils_1.logger.info('');
@@ -109,7 +154,7 @@ void (async () => {
             process.exit(1);
         }
         const checkNames = [...new Set(args.map(arg => COMMAND_TO_CHECK[arg]))];
-        const report = await (0, core_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true });
+        const report = await (0, core_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true, full });
         process.exit(report.ok ? 0 : 1);
     }
     catch (err) {

package/dist/config/constants.d.ts

@@ -55,6 +55,7 @@ export declare const SOURCE_EXTENSIONS: {
 export declare const DEFAULT_COMMANDS: {
     'npx pr-checkmate init': string;
     'npx pr-checkmate all': string;
+    'npx pr-checkmate all --full': string;
     'npx pr-checkmate lint': string;
     'npx pr-checkmate prettier': string;
     'npx pr-checkmate deps': string;

package/dist/config/constants.js

@@ -181,7 +181,8 @@ exports.SOURCE_EXTENSIONS = {
 };
 exports.DEFAULT_COMMANDS = {
     'npx pr-checkmate init': 'Update pr-checkmate.json',
-    'npx pr-checkmate all': 'Run all checks',
+    'npx pr-checkmate all': 'Run all checks (the PR diff in CI, every tracked file locally)',
+    'npx pr-checkmate all --full': 'Run all checks over every tracked file, CI included',
     'npx pr-checkmate lint': 'Lint code using ESLint',
     'npx pr-checkmate prettier': 'Format code using Prettier',
     'npx pr-checkmate deps': 'Check project dependencies',

package/dist/core/checks/languages/lint.js

@@ -57,6 +57,13 @@ exports.lintCheck = {
         // parser, breaking TypeScript linting. Only pass it on the legacy path.
         if (version < 9)
             args.push('--ext', '.ts,.tsx,.js,.jsx');
+        // Files are named explicitly, so any of them that the config ignores produces a
+        // "File ignored because of a matching ignore pattern" warning. That is a fact
+        // about the config, not about the client's code, and a whole-repo run surfaces
+        // one per ignored-but-tracked file (`.eslintrc.js`, generated sources). The flag
+        // suppresses the warning only — nothing changes about which files are linted.
+        if (version >= 9)
+            args.push('--no-warn-ignored');
         // Only auto-fix when the caller allows file mutations.
         if (ctx.write)
             args.push('--fix');

package/dist/core/checks/pr/commitlint.js

@@ -63,9 +63,20 @@ exports.commitlintCheck = {
         const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
         const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
         let tempConfigFile = null;
-        const from = ctx.baseSha ?? 'HEAD~1';
-        const to = ctx.headSha ?? 'HEAD';
-        const args = ['--from', from, '--to', to, '--verbose'];
+        // With no diff range (a full-repo review, or `--full`) the check still has a
+        // meaningful subject: the newest commit message. `HEAD~1` cannot be assumed to
+        // exist, though — it is absent on a repository's first commit and in a shallow
+        // clone (`actions/checkout` fetches depth 1 by default). Passing it blind made
+        // commitlint die with an unhandled "ambiguous argument 'HEAD~1..HEAD'" stack
+        // trace in the client's log, and the check then reported "commit message
+        // violations found" — a verdict about code quality for what was a crash.
+        // `--last` lints exactly the newest commit and needs no ancestor.
+        const range = ctx.baseSha
+            ? ['--from', ctx.baseSha, '--to', ctx.headSha ?? 'HEAD']
+            : (await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD~1'))
+                ? ['--from', 'HEAD~1', '--to', ctx.headSha ?? 'HEAD']
+                : ['--last'];
+        const args = [...range, '--verbose'];
         try {
             if (hasLocal) {
                 utils_1.logger.info('[Commitlint]: Using local config');

package/dist/core/checks/quality/yaml-lint.d.ts

@@ -1,4 +1,11 @@
 import { Check } from '../../types';
+/**
+ * True when a parser problem describes something actually wrong with the file —
+ * a syntax error, a duplicate key, a tab used for indentation.
+ */
+export declare function isFileDefect(problem: {
+    code?: string;
+}): boolean;
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file

package/dist/core/checks/quality/yaml-lint.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.yamlLintCheck = void 0;
+exports.isFileDefect = isFileDefect;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const yaml_1 = require("yaml");
@@ -15,6 +16,28 @@ const findings_1 = require("../findings");
 function shortMessage(message) {
     return message.split('\n')[0].trim();
 }
+/**
+ * Parser problems that are not defects in the file.
+ *
+ * `TAG_RESOLVE_FAILED` means the parser met an application-specific tag it has no
+ * schema for. YAML is explicitly extensible there, so the document is valid and the
+ * parser simply is not the application that defines the tag: `!Ref`, `!Sub`,
+ * `!GetAtt`, `!Equals` in CloudFormation and SAM templates, `!include` in Home
+ * Assistant, `!vault` in Ansible. Reporting those calls a whole ecosystem's valid
+ * files broken — one CloudFormation template produced **557 blocking findings** for
+ * a client, none of which was a real problem.
+ *
+ * Matched on the parser's `code`, not on message text, so a wording change upstream
+ * cannot silently re-enable it.
+ */
+const NON_DEFECT_CODES = new Set(['TAG_RESOLVE_FAILED']);
+/**
+ * True when a parser problem describes something actually wrong with the file —
+ * a syntax error, a duplicate key, a tab used for indentation.
+ */
+function isFileDefect(problem) {
+    return problem.code === undefined || !NON_DEFECT_CODES.has(problem.code);
+}
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
@@ -60,7 +83,7 @@ exports.yamlLintCheck = {
             // so a single malformed file cannot abort the whole check.
             const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true });
             for (const doc of docs) {
-                for (const problem of [...doc.errors, ...doc.warnings]) {
+                for (const problem of [...doc.errors, ...doc.warnings].filter(isFileDefect)) {
                     const pos = problem.linePos?.[0];
                     issues.push({
                         file,

package/dist/core/checks/security/security.js

@@ -39,10 +39,30 @@ exports.securityCheck = {
         // times out in locked-down/offline CI (the scanner already falls back to
         // this exact version). Overridable via `security.gitleaks.version`.
         const gitleaksVersion = ctx.config.security?.gitleaks?.version ?? '8.30.0';
-        const args = ['--diff-mode', 'ci', '--gitleaks-version', gitleaksVersion];
+        // The scan scope has to follow the run's scope. `--diff-mode ci` REQUIRES
+        // HEAD_SHA and aborts without it, so on a full-scan run (no diff range — the
+        // local default) it exited 2 and the secret scan silently became a warning
+        // about the scanner instead of a review of the code. `history` is the only
+        // whole-repository mode the scanner offers; it walks the full commit history,
+        // which took ~1s over 700 commits here but is worth bounding on a large
+        // monorepo via `security.gitleaks.depth`.
+        const isDelta = Boolean(ctx.baseSha);
+        const depth = ctx.config.security?.gitleaks?.depth;
+        // History mode needs a repository to walk. Without one the scanner exits 2
+        // after printing `fatal: not a git repository` and "An unexpected error
+        // occurred" — alarming output about the tool, for a directory it was never
+        // able to review. Every other check skips when git is unusable; so does this.
+        if (!isDelta && !(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD'))) {
+            return (0, types_1.skip)('git history unavailable');
+        }
+        const args = isDelta
+            ? ['--diff-mode', 'ci']
+            : ['--diff-mode', 'history', ...(depth ? ['--depth', String(depth)] : [])];
+        args.push('--gitleaks-version', gitleaksVersion);
         if (!hasClientConfig) {
             args.push('--config', (0, config_1.getPackageConfigPath)('gitleaks.toml'));
         }
+        utils_1.logger.info(`[Security Scan]: scanning ${isDelta ? 'the diff range' : `full history${depth ? ` (last ${depth} commits)` : ''}`}`);
         const env = {
             ...process.env,
             ...(ctx.headSha ? { HEAD_SHA: ctx.headSha } : {}),

package/dist/core/context.d.ts

@@ -1,6 +1,53 @@
 import type { CheckContext, RunOptions } from './types';
+/**
+ * What a run should look at, before any git call is made. Separated from
+ * {@link resolveDiffRange} so the precedence rules are a pure function of the
+ * options and the environment — the part worth pinning with tests.
+ *
+ * - `full` — every tracked file. Checks fall back to `git ls-files` when the range
+ *   is undefined, so this is expressed by resolving to no SHAs at all.
+ * - `staged` — index vs HEAD (pre-commit).
+ * - `explicit` — SHAs the caller supplied.
+ * - `github-event` — base SHA from the pull_request event payload.
+ * - `ref` — diff against a named ref (a PR's destination branch, or `HEAD^`).
+ */
+type RangePlan = {
+    kind: 'full';
+    reason: string;
+} | {
+    kind: 'staged';
+} | {
+    kind: 'explicit';
+    baseSha?: string;
+    headSha?: string;
+} | {
+    kind: 'github-event';
+} | {
+    kind: 'ref';
+    ref: string;
+    reason: string;
+};
+/**
+ * Decide what to look at. Order matters and is the contract:
+ *
+ * 1. `full` wins over everything — an explicit "check all of it" must not be
+ *    quietly narrowed by a CI variable that happens to be set.
+ * 2. `staged`, then caller-supplied SHAs.
+ * 3. The CI platform's PR context (GitHub event payload, Bitbucket destination
+ *    branch) — a gate exists to judge the diff.
+ * 4. A CI build with no PR context still diffs `HEAD^`: it is a push/branch build,
+ *    and delta is why CI runs are fast.
+ * 5. Anything else is a human at a terminal → full scan. `HEAD^` used to be the
+ *    fallback here, which meant a local `pr-checkmate all` judged only the last
+ *    commit and could report a clean project with a `debugger` committed earlier.
+ *
+ * @param opts Run options as passed to `runChecks`.
+ * @param env Environment to read CI markers from. Defaults to the current process.
+ */
+export declare function planDiffRange(opts: RunOptions, env?: NodeJS.ProcessEnv): RangePlan;
 /**
  * Assemble the shared CheckContext once per run. Language detection is skipped
  * when the caller supplies `languages` (e.g. PRValidator passes its ProjectType).
  */
 export declare function buildContext(opts?: RunOptions): Promise<CheckContext>;
+export {};

package/dist/core/context.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.planDiffRange = planDiffRange;
 exports.buildContext = buildContext;
 const node_fs_1 = __importDefault(require("node:fs"));
 const loader_1 = require("../config/loader");
@@ -10,41 +11,71 @@ const utils_1 = require("../utils");
 const detect_language_1 = require("../utils/detect-language");
 const execa_1 = require("../utils/execa");
 /**
- * Resolve the diff range for delta-aware checks.
- * Prefers explicit opts, then GitHub PR event, then Bitbucket PR env, then git HEAD^.
- * Returns undefined SHAs when nothing usable is found → checks fall back to full scan.
+ * Decide what to look at. Order matters and is the contract:
+ *
+ * 1. `full` wins over everything — an explicit "check all of it" must not be
+ *    quietly narrowed by a CI variable that happens to be set.
+ * 2. `staged`, then caller-supplied SHAs.
+ * 3. The CI platform's PR context (GitHub event payload, Bitbucket destination
+ *    branch) — a gate exists to judge the diff.
+ * 4. A CI build with no PR context still diffs `HEAD^`: it is a push/branch build,
+ *    and delta is why CI runs are fast.
+ * 5. Anything else is a human at a terminal → full scan. `HEAD^` used to be the
+ *    fallback here, which meant a local `pr-checkmate all` judged only the last
+ *    commit and could report a clean project with a `debugger` committed earlier.
+ *
+ * @param opts Run options as passed to `runChecks`.
+ * @param env Environment to read CI markers from. Defaults to the current process.
  */
+function planDiffRange(opts, env = process.env) {
+    if (opts.full)
+        return { kind: 'full', reason: 'requested' };
+    if (opts.staged)
+        return { kind: 'staged' };
+    if (opts.baseSha || opts.headSha) {
+        return { kind: 'explicit', baseSha: opts.baseSha, headSha: opts.headSha };
+    }
+    if (env.GITHUB_EVENT_NAME === 'pull_request' && env.GITHUB_EVENT_PATH) {
+        return { kind: 'github-event' };
+    }
+    if (env.BITBUCKET_PR_DESTINATION_BRANCH) {
+        return {
+            kind: 'ref',
+            ref: `origin/${env.BITBUCKET_PR_DESTINATION_BRANCH}`,
+            reason: 'PR build',
+        };
+    }
+    if ((0, utils_1.isCiEnvironment)(env))
+        return { kind: 'ref', ref: 'HEAD^', reason: 'CI build, no PR context' };
+    return { kind: 'full', reason: 'no CI detected' };
+}
 /**
- * Resolve a git ref to a concrete commit SHA, or undefined when it can't be
- * resolved in this clone. `--verify --quiet` emits nothing (instead of echoing
- * the literal ref) and exits non-zero for a missing ref — e.g. `HEAD^` on a
- * single-commit repo, or a base branch not fetched in a shallow CI clone. That
- * way an unresolvable base yields `undefined` and callers fall back to a full
- * scan, rather than diffing against a garbage ref and silently checking nothing.
+ * Carry out a {@link RangePlan}. Every path that cannot produce a usable base
+ * commit returns no SHAs, which the checks read as "scan everything" — degrading
+ * to a full scan is always safer than diffing against a ref that isn't there and
+ * silently reviewing nothing.
+ *
+ * @returns The resolved range, plus a label for the log line.
  */
-async function resolveRef(cwd, ref) {
-    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
-        cwd,
-        reject: false,
-    });
-    return stdout.trim() || undefined;
-}
 async function resolveDiffRange(cwd, opts) {
+    const plan = planDiffRange(opts, process.env);
+    if (plan.kind === 'full')
+        return { scope: `full (${plan.reason})` };
     // Pre-commit mode: diff HEAD against the current index. `git write-tree`
     // materialises the staged index as a real tree object, so every check that
     // diffs baseSha..headSha sees exactly the staged changes — no per-check code.
-    if (opts.staged) {
+    if (plan.kind === 'staged') {
         try {
             const head = (await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
             const tree = (await (0, execa_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
-            return { baseSha: head, headSha: tree };
+            return { baseSha: head, headSha: tree, scope: 'staged' };
         }
         catch {
-            return {};
+            return { scope: 'full (no staged range)' };
         }
     }
-    if (opts.baseSha || opts.headSha) {
-        return { baseSha: opts.baseSha, headSha: opts.headSha };
+    if (plan.kind === 'explicit') {
+        return { baseSha: plan.baseSha, headSha: plan.headSha, scope: 'delta (explicit)' };
     }
     let headSha;
     try {
@@ -52,30 +83,32 @@ async function resolveDiffRange(cwd, opts) {
         headSha = stdout.trim();
     }
     catch {
-        return {};
+        return { scope: 'full (no HEAD)' };
     }
     // GitHub Actions: the PR event payload carries the base branch SHA. Read it
     // directly so delta works without relying on any client-set variable
     // (GITHUB_EVENT_* are injected by the runner).
-    if (process.env.GITHUB_EVENT_NAME === 'pull_request' && process.env.GITHUB_EVENT_PATH) {
+    if (plan.kind === 'github-event') {
         try {
             const event = JSON.parse(node_fs_1.default.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf-8'));
             const eventBase = event?.pull_request?.base?.sha;
             // Only use it if the commit is actually present in this clone; otherwise
             // fall through so a shallow clone degrades to a full scan, not 0 files.
-            const baseSha = eventBase ? await resolveRef(cwd, eventBase) : undefined;
+            const baseSha = eventBase ? await (0, utils_1.resolveGitRef)(cwd, eventBase) : undefined;
             if (baseSha)
-                return { baseSha, headSha };
+                return { baseSha, headSha, scope: 'delta (PR event)' };
         }
         catch {
-            // Malformed/unreadable event — fall through to the git-based resolution.
+            // Malformed/unreadable event — fall through to a full scan below.
         }
+        return { headSha, scope: 'full (PR base unavailable)' };
     }
-    // Bitbucket exposes the PR destination branch as an env var (also runner-set).
-    const bitbucketTarget = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
-    const ref = bitbucketTarget ? `origin/${bitbucketTarget}` : 'HEAD^';
-    const baseSha = await resolveRef(cwd, ref);
-    return { baseSha, headSha };
+    const baseSha = await (0, utils_1.resolveGitRef)(cwd, plan.ref);
+    return {
+        baseSha,
+        headSha,
+        scope: baseSha ? `delta (${plan.ref}, ${plan.reason})` : `full (${plan.ref} unresolvable)`,
+    };
 }
 /**
  * Assemble the shared CheckContext once per run. Language detection is skipped
@@ -84,9 +117,15 @@ async function resolveDiffRange(cwd, opts) {
 async function buildContext(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const config = opts.config ?? (0, loader_1.loadProjectConfig)();
-    const languages = opts.languages ?? (await (0, detect_language_1.detectLanguages)(cwd));
-    const { baseSha, headSha } = await resolveDiffRange(cwd, opts);
-    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false}`);
+    // Detection reads the client's `ignoreDirs` from the config already loaded here,
+    // rather than calling getIgnoredDirs() — that one resolves against process.cwd(),
+    // which is not necessarily the `cwd` under review.
+    const languages = opts.languages ?? (await (0, detect_language_1.detectLanguages)(cwd, config.ignoreDirs));
+    const { baseSha, headSha, scope } = await resolveDiffRange(cwd, opts);
+    // `scope` is logged because it decides what the whole run looks at, and getting
+    // it wrong is invisible in the results: a run that reviewed one commit and one
+    // that reviewed the repository both just print passes.
+    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false} scope=${scope}`);
     return {
         cwd,
         languages,

package/dist/core/targets.js

@@ -27,7 +27,7 @@ function excludeIgnoredDirs(files, keepDirs = []) {
         ignored.delete(dir);
     if (ignored.size === 0)
         return files;
-    return files.filter(f => !f.split('/').some(segment => ignored.has(segment)));
+    return files.filter(f => !(0, utils_1.isUnderIgnoredDir)(f, ignored));
 }
 /**
  * Lists the files a language check should operate on, matched by pathspec `globs`

package/dist/core/types.d.ts

@@ -90,6 +90,15 @@ export interface RunOptions {
      * (`git write-tree`), so every delta-aware check works unchanged.
      */
     staged?: boolean;
+    /**
+     * Review every tracked file instead of a diff (`--full` on the CLI, and the
+     * default when no CI environment is detected). Takes precedence over every other
+     * range source, including CI variables — see `planDiffRange`. The 16 checks that
+     * are about a diff by definition (PR Size, Diff Security, Merge Conflict, …) gate
+     * their own `applies` on `baseSha`, so they drop out of the report rather than
+     * misreporting.
+     */
+    full?: boolean;
 }
 export interface CheckReport {
     results: CheckResult[];

package/dist/init.js

@@ -11,20 +11,6 @@ const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("./config");
 const utils_1 = require("./utils");
 const CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
-/**
- * Load the canonical default ESLint rules (the same set eslint.config.mjs
- * applies) so the generated pr-checkmate.json lists every rule for the user to
- * change or disable. Falls back to an empty object if the file is unavailable.
- */
-function loadDefaultEslintRules() {
-    try {
-        return JSON.parse(fs_1.default.readFileSync((0, config_1.getPackageConfigPath)('eslint-default-rules.json'), 'utf-8'));
-    }
-    catch (err) {
-        utils_1.logger.warn(`[init]: ⚠️ Could not load default ESLint rules: ${err}`);
-        return {};
-    }
-}
 /**
  * Default configuration structure with customization options
  */
@@ -48,10 +34,22 @@ const DEFAULT_CONFIG = {
     // Directories excluded from every check (matched on any path segment). Edit
     // freely — add your own generated/vendored dirs or remove ones you want scanned.
     ignoreDirs: config_1.IGNORED_DIRS,
-    // ESLint — the full default rule set is written out so every rule is visible
-    // and editable. Change any value, or set a rule to "off" to disable it.
+    // ESLint — `rules` starts EMPTY on purpose and holds overrides only, each merged
+    // over the bundled default for that one rule.
+    //
+    // It used to be written out in full (all 27 rules with their severities) so every
+    // rule was visible and editable in this file. That copy then won over the bundled
+    // defaults forever: `eslint.rules` is in REPLACED_OBJECT_PATHS, so a later `init`
+    // keeps the user's block wholesale, and improvements to the defaults never reached
+    // a repo that had ever run `init`. Downgrading `prettier/prettier` from error to
+    // warn — so formatting stops failing pipelines — is exactly such an improvement,
+    // and it stopped at the config boundary for every existing client.
+    //
+    // The full list with defaults lives in the ESLint check documentation and in the
+    // package's own eslint-default-rules.json; discoverability there costs nothing,
+    // un-updatable defaults cost every client an edit.
     eslint: {
-        rules: loadDefaultEslintRules(),
+        rules: {},
         ignorePatterns: [],
     },
     // Prettier customization

package/dist/interfaces/index.d.ts

@@ -61,6 +61,7 @@ export interface PRCheckMateConfig {
         gitleaks?: {
             enabled?: boolean;
             version?: string;
+            depth?: number;
         };
         'npm-audit'?: {
             enabled?: boolean;

package/dist/utils/ci.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;

package/dist/utils/ci.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCiEnvironment = isCiEnvironment;
+/**
+ * Environment variables that mean "this is an automated build". `CI` alone covers
+ * GitHub Actions, GitLab, Bitbucket, CircleCI, Buildkite, Travis and most others;
+ * the rest are providers that either predate the convention or set only their own
+ * marker (Jenkins, TeamCity, Azure Pipelines, AWS CodeBuild).
+ *
+ * This answers a different question from `detectPlatform()` in reporters.ts, which
+ * picks WHERE to post a PR comment and therefore only knows the three platforms we
+ * can comment on. A Jenkins build is CI but has nowhere to post.
+ */
+const CI_ENV_VARS = [
+    'CI',
+    'GITHUB_ACTIONS',
+    'GITLAB_CI',
+    'BITBUCKET_BUILD_NUMBER',
+    'JENKINS_URL',
+    'TEAMCITY_VERSION',
+    'TF_BUILD',
+    'CIRCLECI',
+    'BUILDKITE',
+    'CODEBUILD_BUILD_ID',
+];
+/** Values that are present but mean "no" — some tooling exports `CI=false`. */
+const FALSY = new Set(['', '0', 'false', 'no', 'off']);
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+function isCiEnvironment(env = process.env) {
+    return CI_ENV_VARS.some(name => {
+        const value = env[name];
+        return value !== undefined && !FALSY.has(value.trim().toLowerCase());
+    });
+}

package/dist/utils/detect-language.d.ts

@@ -4,7 +4,12 @@ export type Language = 'typescript' | 'javascript' | 'python' | 'cpp' | 'swift'
  * with tracked source-file counts (breadth). A language is reported when it has a
  * marker file OR at least one tracked source file.
  *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
  * @returns languages ordered by tracked file count (most-used first). `.h` headers
  *   are intentionally excluded from the C++ count since they are ambiguous with C.
  */
-export declare function detectLanguages(root?: string): Promise<Language[]>;
+export declare function detectLanguages(root?: string, ignoreDirs?: string[]): Promise<Language[]>;

package/dist/utils/detect-language.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectLanguages = detectLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../config/constants");
 const execa_1 = require("./execa");
 const glob_1 = require("./glob");
 const logger_1 = require("./logger");
@@ -70,7 +71,7 @@ function hasMarker(root, lang) {
  * when git is unavailable or the directory is not a repo — callers then fall
  * back to marker files alone.
  */
-async function countTrackedFiles(root) {
+async function countTrackedFiles(root, ignoreDirs) {
     const counts = {
         typescript: 0,
         javascript: 0,
@@ -87,9 +88,18 @@ async function countTrackedFiles(root) {
     try {
         const { stdout } = await (0, execa_1.execa)('git', ['ls-files'], { cwd: root });
         const files = stdout.split('\n').map(f => f.trim());
+        const ignored = new Set(ignoreDirs);
         for (const file of files) {
             if (!file)
                 continue;
+            // A repository that commits its dependencies (`node_modules`, `vendor`,
+            // `third_party`) would otherwise be detected as a Python/Go/PHP project off
+            // the back of files nobody in it wrote, switching on whole toolchains for
+            // languages absent from the source. Detection has to describe the repo's own
+            // code, since it decides which checks run at all — the same exclusion every
+            // check's file list already applies via `excludeIgnoredDirs`.
+            if ((0, glob_1.isUnderIgnoredDir)(file, ignored))
+                continue;
             const ext = node_path_1.default.extname(file).toLowerCase();
             for (const lang of Object.keys(EXTENSIONS)) {
                 if (EXTENSIONS[lang].includes(ext)) {
@@ -109,11 +119,16 @@ async function countTrackedFiles(root) {
  * with tracked source-file counts (breadth). A language is reported when it has a
  * marker file OR at least one tracked source file.
  *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
  * @returns languages ordered by tracked file count (most-used first). `.h` headers
  *   are intentionally excluded from the C++ count since they are ambiguous with C.
  */
-async function detectLanguages(root = process.cwd()) {
-    const counts = await countTrackedFiles(root);
+async function detectLanguages(root = process.cwd(), ignoreDirs = constants_1.IGNORED_DIRS) {
+    const counts = await countTrackedFiles(root, ignoreDirs);
     const detected = Object.keys(EXTENSIONS).filter(lang => hasMarker(root, lang) || counts[lang] > 0);
     detected.sort((a, b) => counts[b] - counts[a]);
     const countStr = Object.keys(counts).map(l => `${l}=${counts[l]}`).join(', ');

package/dist/utils/git.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+export declare function resolveGitRef(cwd: string, ref: string): Promise<string | undefined>;

package/dist/utils/git.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGitRef = resolveGitRef;
+const execa_1 = require("./execa");
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+async function resolveGitRef(cwd, ref) {
+    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
+        cwd,
+        reject: false,
+    });
+    return stdout.trim() || undefined;
+}

package/dist/utils/glob.d.ts

@@ -8,3 +8,17 @@
 export declare function globToRegExp(glob: string): RegExp;
 /** True when `file` matches any of the glob `patterns`. */
 export declare function matchesAnyGlob(file: string, patterns: string[]): boolean;
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+export declare function isUnderIgnoredDir(file: string, ignoredDirs: Iterable<string>): boolean;

package/dist/utils/glob.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.globToRegExp = globToRegExp;
 exports.matchesAnyGlob = matchesAnyGlob;
+exports.isUnderIgnoredDir = isUnderIgnoredDir;
 /**
  * Minimal glob → RegExp for path matching against config patterns. Supports `*`
  * (matches within a path segment), `**` (across segments), and a leading `** /`
@@ -23,3 +24,22 @@ function globToRegExp(glob) {
 function matchesAnyGlob(file, patterns) {
     return patterns.some(p => globToRegExp(p).test(file));
 }
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+function isUnderIgnoredDir(file, ignoredDirs) {
+    const ignored = ignoredDirs instanceof Set ? ignoredDirs : new Set(ignoredDirs);
+    if (ignored.size === 0)
+        return false;
+    return file.split('/').some(segment => ignored.has(segment));
+}

package/dist/utils/index.d.ts

@@ -6,6 +6,8 @@ export * from './direct-deps';
 export * from './detect-language';
 export * from './glob';
 export * from './update-notifier';
+export * from './ci';
+export * from './git';
 /**
  *
  */

package/dist/utils/index.js

@@ -28,6 +28,8 @@ __exportStar(require("./direct-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 __exportStar(require("./glob"), exports);
 __exportStar(require("./update-notifier"), exports);
+__exportStar(require("./ci"), exports);
+__exportStar(require("./git"), exports);
 /**
  *
  */

package/eslint-default-rules.json

@@ -13,13 +13,13 @@
   "space-before-function-paren": "off",
   "operator-linebreak": "off",
   "max-len": ["warn", { "code": 100 }],
-  "semi": ["error", "always"],
-  "quotes": ["error", "single", { "avoidEscape": true }],
-  "object-curly-spacing": ["error", "always"],
-  "space-infix-ops": "error",
-  "keyword-spacing": ["error", { "before": true, "after": true }],
+  "semi": ["warn", "always"],
+  "quotes": ["warn", "single", { "avoidEscape": true }],
+  "object-curly-spacing": ["warn", "always"],
+  "space-infix-ops": "warn",
+  "keyword-spacing": ["warn", { "before": true, "after": true }],
   "padding-line-between-statements": [
-    "error",
+    "warn",
     { "blankLine": "always", "prev": "block", "next": "*" },
     { "blankLine": "always", "prev": "*", "next": "return" }
   ],
@@ -50,7 +50,7 @@
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",
   "prettier/prettier": [
-    "error",
+    "warn",
     {
       "semi": true,
       "singleQuote": true,

package/eslint.config.mjs

@@ -12,6 +12,22 @@ import jsdocPlugin from 'eslint-plugin-jsdoc';
  * Default ESLint rules — single source of truth, shared with init.ts so the
  * pr-checkmate.json it generates lists exactly the rules applied here. Edit the
  * rules in `eslint-default-rules.json` (shipped alongside this file).
+ *
+ * SEVERITY POLICY: `error` is reserved for defects a human has to resolve —
+ * `no-debugger`, `eqeqeq`, `prefer-const`, `@typescript-eslint/no-unused-vars`,
+ * `@typescript-eslint/no-floating-promises`, `import/no-duplicates`. Everything
+ * that is purely formatting is `warn`, even
+ * though it is auto-fixable, precisely BECAUSE it is auto-fixable: ESLint exits 1
+ * on errors only, and the ESLint check maps exit 1 to a blocking failure, so an
+ * `error`-level whitespace rule turns `npx prettier --write` worth of work into a
+ * red gate on someone's PR. Formatting still gets reported — as a warning here and
+ * by the dedicated Prettier check, which has always been advisory. A repo that
+ * wants formatting to gate promotes it back with
+ * `eslint.rules: { "prettier/prettier": "error" }` or
+ * `severity: { "Prettier": "error" }` in pr-checkmate.json.
+ *
+ * A JSON file cannot carry this note, hence it lives here; `src/config/.eslintrc.js`
+ * holds the same rule set for the legacy ESLint <9 path and must stay in sync.
  */
 const require = createRequire(import.meta.url);
 export const defaultRules = require('./eslint-default-rules.json');
@@ -34,7 +50,7 @@ const defaultIgnores = [
 function loadUserConfig() {
   let currentDir = process.cwd();
   let configPath = path.join(currentDir, 'pr-checkmate.json');
-  
+
   // If running from node_modules, find project root
   if (currentDir.includes('node_modules')) {
     const parts = currentDir.split(path.sep);
@@ -44,7 +60,7 @@ function loadUserConfig() {
       configPath = path.join(currentDir, 'pr-checkmate.json');
     }
   }
-  
+
   if (fs.existsSync(configPath)) {
     try {
       const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
@@ -56,7 +72,7 @@ function loadUserConfig() {
   } else {
     console.error(`[loadUserConfig]: No pr-checkmate.json found, using defaults`);
   }
-  
+
   return { sourcePath: 'src', eslint: {} };
 }
 
@@ -117,4 +133,4 @@ export default [
 
     rules: mergedRules,
   },
-];
+];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.20",
+    "version": "1.23.21",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -51,6 +51,7 @@
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
         "test": "node --require ts-node/register --test \"src/**/*.test.ts\"",
+        "verify:tarball": "bash scripts/verify-tarball.sh",
         "security-scan": "npx pr-checkmate security",
         "clean": "rm -rf dist",
         "release": "standard-version"

package/pr-checkmate.schema.json

@@ -108,7 +108,12 @@
           "type": "object",
           "properties": {
             "enabled": { "type": "boolean" },
-            "version": { "type": "string" }
+            "version": { "type": "string" },
+            "depth": {
+              "description": "Caps the whole-repository history scan used when there is no diff range (a local run or --full) to the last N commits. Ignored in a PR run, which scans the diff range.",
+              "type": "integer",
+              "minimum": 1
+            }
           }
         },
         "npm-audit": {

package/src/config/.eslintrc.js

@@ -70,13 +70,15 @@ module.exports = {
     'space-before-function-paren': 'off',
     'operator-linebreak': 'off',
     'max-len': ['warn', { code: 100 }],
-    semi: ['error', 'always'],
-    quotes: ['error', 'single', { avoidEscape: true }],
-    'object-curly-spacing': ['error', 'always'],
-    'space-infix-ops': 'error',
-    'keyword-spacing': ['error', { before: true, after: true }],
+    // Formatting is advisory — see the note above `rules` in eslint-flat-config.mjs.
+    // Keep these in sync with src/config/eslint-default-rules.json.
+    semi: ['warn', 'always'],
+    quotes: ['warn', 'single', { avoidEscape: true }],
+    'object-curly-spacing': ['warn', 'always'],
+    'space-infix-ops': 'warn',
+    'keyword-spacing': ['warn', { before: true, after: true }],
     'padding-line-between-statements': [
-      'error',
+      'warn',
       { blankLine: 'always', prev: 'block', next: '*' },
       { blankLine: 'always', prev: '*', next: 'return' },
     ],
@@ -108,7 +110,7 @@ module.exports = {
     'jsdoc/check-tag-names': 'warn',
     'jsdoc/check-types': 'warn',
     'prettier/prettier': [
-      'error',
+      'warn',
       {
         semi: true,
         singleQuote: true,

package/src/config/cspell.json

@@ -903,6 +903,7 @@
     "riskfolio",
     "robolectric",
     "rowwise",
+    "rseidelsohn",
     "Rshum",
     "rtol",
     "rtype",
@@ -1010,6 +1011,7 @@
     "taxinfo",
     "Tayebeh",
     "tcwf",
+    "teamcity",
     "telaviv",
     "temurin",
     "Tenés",

package/src/config/eslint-default-rules.json

@@ -13,13 +13,13 @@
   "space-before-function-paren": "off",
   "operator-linebreak": "off",
   "max-len": ["warn", { "code": 100 }],
-  "semi": ["error", "always"],
-  "quotes": ["error", "single", { "avoidEscape": true }],
-  "object-curly-spacing": ["error", "always"],
-  "space-infix-ops": "error",
-  "keyword-spacing": ["error", { "before": true, "after": true }],
+  "semi": ["warn", "always"],
+  "quotes": ["warn", "single", { "avoidEscape": true }],
+  "object-curly-spacing": ["warn", "always"],
+  "space-infix-ops": "warn",
+  "keyword-spacing": ["warn", { "before": true, "after": true }],
   "padding-line-between-statements": [
-    "error",
+    "warn",
     { "blankLine": "always", "prev": "block", "next": "*" },
     { "blankLine": "always", "prev": "*", "next": "return" }
   ],
@@ -50,7 +50,7 @@
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",
   "prettier/prettier": [
-    "error",
+    "warn",
     {
       "semi": true,
       "singleQuote": true,

package/src/config/pr-checkmate.schema.json

@@ -108,7 +108,12 @@
           "type": "object",
           "properties": {
             "enabled": { "type": "boolean" },
-            "version": { "type": "string" }
+            "version": { "type": "string" },
+            "depth": {
+              "description": "Caps the whole-repository history scan used when there is no diff range (a local run or --full) to the last N commits. Ignored in a PR run, which scans the diff range.",
+              "type": "integer",
+              "minimum": 1
+            }
           }
         },
         "npm-audit": {