pr-checkmate 1.23.20 → 1.23.22

package/dist/cli.js

@@ -56,8 +56,51 @@ const COMMAND_TO_CHECK = {
 };
 /** Commands that run the whole pipeline (or no pipeline at all) and take no siblings. */
 const STANDALONE_COMMANDS = ['init', 'all', 'precommit'];
-const args = process.argv.slice(2);
+/** Flags accepted anywhere on the command line, with what each one means. */
+const FLAGS = {
+    '--full': 'review every tracked file instead of the diff (the default outside CI)',
+};
+const argv = process.argv.slice(2);
+/**
+ * Flags are separated from positional arguments so they compose with every command
+ * — scope is orthogonal to which checks run, hence `pr-checkmate lint --full` as
+ * well as `pr-checkmate all --full`.
+ */
+const flags = argv.filter(arg => arg.startsWith('-'));
+const args = argv.filter(arg => !arg.startsWith('-'));
 const cmd = args[0];
+/**
+ * An unrecognised flag aborts the run. Ignoring it would report success for a scope
+ * the user did not ask for: a misspelling of `--full` must not quietly review the
+ * diff and print a green summary.
+ */
+function rejectUnknownFlags() {
+    const unknown = flags.filter(flag => !FLAGS[flag]);
+    if (unknown.length === 0)
+        return;
+    const known = Object.entries(FLAGS)
+        .map(([flag, help]) => `${flag} (${help})`)
+        .join(', ');
+    utils_1.logger.error(`[cli]: Unknown flag(s) "${unknown.join('", "')}". Available: ${known}`);
+    process.exit(1);
+}
+/**
+ * `--full` and `precommit` ask for different things — every tracked file versus the
+ * staged changes only. `planDiffRange` resolves the conflict in favour of `--full`,
+ * which would silently turn a pre-commit hook into a whole-repo scan, so the
+ * contradiction is refused here instead.
+ */
+function rejectConflictingScope() {
+    if (cmd === 'precommit' && flags.includes('--full')) {
+        utils_1.logger.error('[cli]: "precommit --full" is contradictory — precommit reviews the staged changes. Run "pr-checkmate all --full" for a whole-repo review.');
+        process.exit(1);
+    }
+    if (cmd === 'init' && flags.length > 0) {
+        utils_1.logger.error(`[cli]: "init" takes no flags, got: ${flags.join(', ')}.`);
+        process.exit(1);
+    }
+}
+const full = flags.includes('--full');
 /**
  * Reject extra arguments after a standalone command. Silently ignoring them would
  * report success for work that never ran — `pr-checkmate init lint` must not look
@@ -75,6 +118,8 @@ function rejectExtraArgs() {
 }
 void (async () => {
     try {
+        rejectUnknownFlags();
+        rejectConflictingScope();
         rejectExtraArgs();
         if (cmd === 'init') {
             await (0, init_1.init)();
@@ -86,7 +131,7 @@ void (async () => {
             // Fetch the update notice concurrently (best-effort, never blocks/affects
             // the exit code), but print it LAST — after the summary — so it's noticeable.
             const noticePromise = (0, utils_1.getUpdateNotice)();
-            const report = await (0, core_1.runChecks)({ reporter: 'auto', write: true });
+            const report = await (0, core_1.runChecks)({ reporter: 'auto', write: true, full });
             const notice = await noticePromise.catch(() => null);
             if (notice) {
                 utils_1.logger.info('');
@@ -109,7 +154,7 @@ void (async () => {
             process.exit(1);
         }
         const checkNames = [...new Set(args.map(arg => COMMAND_TO_CHECK[arg]))];
-        const report = await (0, core_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true });
+        const report = await (0, core_1.runChecks)({ only: checkNames, reporter: 'stdout', write: true, full });
         process.exit(report.ok ? 0 : 1);
     }
     catch (err) {

package/dist/config/constants.d.ts

@@ -55,6 +55,7 @@ export declare const SOURCE_EXTENSIONS: {
 export declare const DEFAULT_COMMANDS: {
     'npx pr-checkmate init': string;
     'npx pr-checkmate all': string;
+    'npx pr-checkmate all --full': string;
     'npx pr-checkmate lint': string;
     'npx pr-checkmate prettier': string;
     'npx pr-checkmate deps': string;

package/dist/config/constants.js

@@ -181,7 +181,8 @@ exports.SOURCE_EXTENSIONS = {
 };
 exports.DEFAULT_COMMANDS = {
     'npx pr-checkmate init': 'Update pr-checkmate.json',
-    'npx pr-checkmate all': 'Run all checks',
+    'npx pr-checkmate all': 'Run all checks (the PR diff in CI, every tracked file locally)',
+    'npx pr-checkmate all --full': 'Run all checks over every tracked file, CI included',
     'npx pr-checkmate lint': 'Lint code using ESLint',
     'npx pr-checkmate prettier': 'Format code using Prettier',
     'npx pr-checkmate deps': 'Check project dependencies',

package/dist/core/checks/languages/lint.js

@@ -57,6 +57,13 @@ exports.lintCheck = {
         // parser, breaking TypeScript linting. Only pass it on the legacy path.
         if (version < 9)
             args.push('--ext', '.ts,.tsx,.js,.jsx');
+        // Files are named explicitly, so any of them that the config ignores produces a
+        // "File ignored because of a matching ignore pattern" warning. That is a fact
+        // about the config, not about the client's code, and a whole-repo run surfaces
+        // one per ignored-but-tracked file (`.eslintrc.js`, generated sources). The flag
+        // suppresses the warning only — nothing changes about which files are linted.
+        if (version >= 9)
+            args.push('--no-warn-ignored');
         // Only auto-fix when the caller allows file mutations.
         if (ctx.write)
             args.push('--fix');

package/dist/core/checks/pr/commitlint.js

@@ -63,9 +63,20 @@ exports.commitlintCheck = {
         const commitlintBin = (0, utils_1.resolvePackageBin)('@commitlint/cli', 'cli.js');
         const hasLocal = (0, config_1.hasLocalConfig)(LOCAL_CONFIG_FILES);
         let tempConfigFile = null;
-        const from = ctx.baseSha ?? 'HEAD~1';
-        const to = ctx.headSha ?? 'HEAD';
-        const args = ['--from', from, '--to', to, '--verbose'];
+        // With no diff range (a full-repo review, or `--full`) the check still has a
+        // meaningful subject: the newest commit message. `HEAD~1` cannot be assumed to
+        // exist, though — it is absent on a repository's first commit and in a shallow
+        // clone (`actions/checkout` fetches depth 1 by default). Passing it blind made
+        // commitlint die with an unhandled "ambiguous argument 'HEAD~1..HEAD'" stack
+        // trace in the client's log, and the check then reported "commit message
+        // violations found" — a verdict about code quality for what was a crash.
+        // `--last` lints exactly the newest commit and needs no ancestor.
+        const range = ctx.baseSha
+            ? ['--from', ctx.baseSha, '--to', ctx.headSha ?? 'HEAD']
+            : (await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD~1'))
+                ? ['--from', 'HEAD~1', '--to', ctx.headSha ?? 'HEAD']
+                : ['--last'];
+        const args = [...range, '--verbose'];
         try {
             if (hasLocal) {
                 utils_1.logger.info('[Commitlint]: Using local config');

package/dist/core/checks/quality/yaml-lint.d.ts

@@ -1,4 +1,11 @@
 import { Check } from '../../types';
+/**
+ * True when a parser problem describes something actually wrong with the file —
+ * a syntax error, a duplicate key, a tab used for indentation.
+ */
+export declare function isFileDefect(problem: {
+    code?: string;
+}): boolean;
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file

package/dist/core/checks/quality/yaml-lint.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.yamlLintCheck = void 0;
+exports.isFileDefect = isFileDefect;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const yaml_1 = require("yaml");
@@ -15,6 +16,28 @@ const findings_1 = require("../findings");
 function shortMessage(message) {
     return message.split('\n')[0].trim();
 }
+/**
+ * Parser problems that are not defects in the file.
+ *
+ * `TAG_RESOLVE_FAILED` means the parser met an application-specific tag it has no
+ * schema for. YAML is explicitly extensible there, so the document is valid and the
+ * parser simply is not the application that defines the tag: `!Ref`, `!Sub`,
+ * `!GetAtt`, `!Equals` in CloudFormation and SAM templates, `!include` in Home
+ * Assistant, `!vault` in Ansible. Reporting those calls a whole ecosystem's valid
+ * files broken — one CloudFormation template produced **557 blocking findings** for
+ * a client, none of which was a real problem.
+ *
+ * Matched on the parser's `code`, not on message text, so a wording change upstream
+ * cannot silently re-enable it.
+ */
+const NON_DEFECT_CODES = new Set(['TAG_RESOLVE_FAILED']);
+/**
+ * True when a parser problem describes something actually wrong with the file —
+ * a syntax error, a duplicate key, a tab used for indentation.
+ */
+function isFileDefect(problem) {
+    return problem.code === undefined || !NON_DEFECT_CODES.has(problem.code);
+}
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
@@ -60,7 +83,7 @@ exports.yamlLintCheck = {
             // so a single malformed file cannot abort the whole check.
             const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true });
             for (const doc of docs) {
-                for (const problem of [...doc.errors, ...doc.warnings]) {
+                for (const problem of [...doc.errors, ...doc.warnings].filter(isFileDefect)) {
                     const pos = problem.linePos?.[0];
                     issues.push({
                         file,

package/dist/core/checks/security/security.js

@@ -39,10 +39,30 @@ exports.securityCheck = {
         // times out in locked-down/offline CI (the scanner already falls back to
         // this exact version). Overridable via `security.gitleaks.version`.
         const gitleaksVersion = ctx.config.security?.gitleaks?.version ?? '8.30.0';
-        const args = ['--diff-mode', 'ci', '--gitleaks-version', gitleaksVersion];
+        // The scan scope has to follow the run's scope. `--diff-mode ci` REQUIRES
+        // HEAD_SHA and aborts without it, so on a full-scan run (no diff range — the
+        // local default) it exited 2 and the secret scan silently became a warning
+        // about the scanner instead of a review of the code. `history` is the only
+        // whole-repository mode the scanner offers; it walks the full commit history,
+        // which took ~1s over 700 commits here but is worth bounding on a large
+        // monorepo via `security.gitleaks.depth`.
+        const isDelta = Boolean(ctx.baseSha);
+        const depth = ctx.config.security?.gitleaks?.depth;
+        // History mode needs a repository to walk. Without one the scanner exits 2
+        // after printing `fatal: not a git repository` and "An unexpected error
+        // occurred" — alarming output about the tool, for a directory it was never
+        // able to review. Every other check skips when git is unusable; so does this.
+        if (!isDelta && !(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD'))) {
+            return (0, types_1.skip)('git history unavailable');
+        }
+        const args = isDelta
+            ? ['--diff-mode', 'ci']
+            : ['--diff-mode', 'history', ...(depth ? ['--depth', String(depth)] : [])];
+        args.push('--gitleaks-version', gitleaksVersion);
         if (!hasClientConfig) {
             args.push('--config', (0, config_1.getPackageConfigPath)('gitleaks.toml'));
         }
+        utils_1.logger.info(`[Security Scan]: scanning ${isDelta ? 'the diff range' : `full history${depth ? ` (last ${depth} commits)` : ''}`}`);
         const env = {
             ...process.env,
             ...(ctx.headSha ? { HEAD_SHA: ctx.headSha } : {}),

package/dist/core/context.d.ts

@@ -1,6 +1,53 @@
 import type { CheckContext, RunOptions } from './types';
+/**
+ * What a run should look at, before any git call is made. Separated from
+ * {@link resolveDiffRange} so the precedence rules are a pure function of the
+ * options and the environment — the part worth pinning with tests.
+ *
+ * - `full` — every tracked file. Checks fall back to `git ls-files` when the range
+ *   is undefined, so this is expressed by resolving to no SHAs at all.
+ * - `staged` — index vs HEAD (pre-commit).
+ * - `explicit` — SHAs the caller supplied.
+ * - `github-event` — base SHA from the pull_request event payload.
+ * - `ref` — diff against a named ref (a PR's destination branch, or `HEAD^`).
+ */
+type RangePlan = {
+    kind: 'full';
+    reason: string;
+} | {
+    kind: 'staged';
+} | {
+    kind: 'explicit';
+    baseSha?: string;
+    headSha?: string;
+} | {
+    kind: 'github-event';
+} | {
+    kind: 'ref';
+    ref: string;
+    reason: string;
+};
+/**
+ * Decide what to look at. Order matters and is the contract:
+ *
+ * 1. `full` wins over everything — an explicit "check all of it" must not be
+ *    quietly narrowed by a CI variable that happens to be set.
+ * 2. `staged`, then caller-supplied SHAs.
+ * 3. The CI platform's PR context (GitHub event payload, Bitbucket destination
+ *    branch) — a gate exists to judge the diff.
+ * 4. A CI build with no PR context still diffs `HEAD^`: it is a push/branch build,
+ *    and delta is why CI runs are fast.
+ * 5. Anything else is a human at a terminal → full scan. `HEAD^` used to be the
+ *    fallback here, which meant a local `pr-checkmate all` judged only the last
+ *    commit and could report a clean project with a `debugger` committed earlier.
+ *
+ * @param opts Run options as passed to `runChecks`.
+ * @param env Environment to read CI markers from. Defaults to the current process.
+ */
+export declare function planDiffRange(opts: RunOptions, env?: NodeJS.ProcessEnv): RangePlan;
 /**
  * Assemble the shared CheckContext once per run. Language detection is skipped
  * when the caller supplies `languages` (e.g. PRValidator passes its ProjectType).
  */
 export declare function buildContext(opts?: RunOptions): Promise<CheckContext>;
+export {};

package/dist/core/context.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.planDiffRange = planDiffRange;
 exports.buildContext = buildContext;
 const node_fs_1 = __importDefault(require("node:fs"));
 const loader_1 = require("../config/loader");
@@ -10,41 +11,71 @@ const utils_1 = require("../utils");
 const detect_language_1 = require("../utils/detect-language");
 const execa_1 = require("../utils/execa");
 /**
- * Resolve the diff range for delta-aware checks.
- * Prefers explicit opts, then GitHub PR event, then Bitbucket PR env, then git HEAD^.
- * Returns undefined SHAs when nothing usable is found → checks fall back to full scan.
+ * Decide what to look at. Order matters and is the contract:
+ *
+ * 1. `full` wins over everything — an explicit "check all of it" must not be
+ *    quietly narrowed by a CI variable that happens to be set.
+ * 2. `staged`, then caller-supplied SHAs.
+ * 3. The CI platform's PR context (GitHub event payload, Bitbucket destination
+ *    branch) — a gate exists to judge the diff.
+ * 4. A CI build with no PR context still diffs `HEAD^`: it is a push/branch build,
+ *    and delta is why CI runs are fast.
+ * 5. Anything else is a human at a terminal → full scan. `HEAD^` used to be the
+ *    fallback here, which meant a local `pr-checkmate all` judged only the last
+ *    commit and could report a clean project with a `debugger` committed earlier.
+ *
+ * @param opts Run options as passed to `runChecks`.
+ * @param env Environment to read CI markers from. Defaults to the current process.
  */
+function planDiffRange(opts, env = process.env) {
+    if (opts.full)
+        return { kind: 'full', reason: 'requested' };
+    if (opts.staged)
+        return { kind: 'staged' };
+    if (opts.baseSha || opts.headSha) {
+        return { kind: 'explicit', baseSha: opts.baseSha, headSha: opts.headSha };
+    }
+    if (env.GITHUB_EVENT_NAME === 'pull_request' && env.GITHUB_EVENT_PATH) {
+        return { kind: 'github-event' };
+    }
+    if (env.BITBUCKET_PR_DESTINATION_BRANCH) {
+        return {
+            kind: 'ref',
+            ref: `origin/${env.BITBUCKET_PR_DESTINATION_BRANCH}`,
+            reason: 'PR build',
+        };
+    }
+    if ((0, utils_1.isCiEnvironment)(env))
+        return { kind: 'ref', ref: 'HEAD^', reason: 'CI build, no PR context' };
+    return { kind: 'full', reason: 'no CI detected' };
+}
 /**
- * Resolve a git ref to a concrete commit SHA, or undefined when it can't be
- * resolved in this clone. `--verify --quiet` emits nothing (instead of echoing
- * the literal ref) and exits non-zero for a missing ref — e.g. `HEAD^` on a
- * single-commit repo, or a base branch not fetched in a shallow CI clone. That
- * way an unresolvable base yields `undefined` and callers fall back to a full
- * scan, rather than diffing against a garbage ref and silently checking nothing.
+ * Carry out a {@link RangePlan}. Every path that cannot produce a usable base
+ * commit returns no SHAs, which the checks read as "scan everything" — degrading
+ * to a full scan is always safer than diffing against a ref that isn't there and
+ * silently reviewing nothing.
+ *
+ * @returns The resolved range, plus a label for the log line.
  */
-async function resolveRef(cwd, ref) {
-    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
-        cwd,
-        reject: false,
-    });
-    return stdout.trim() || undefined;
-}
 async function resolveDiffRange(cwd, opts) {
+    const plan = planDiffRange(opts, process.env);
+    if (plan.kind === 'full')
+        return { scope: `full (${plan.reason})` };
     // Pre-commit mode: diff HEAD against the current index. `git write-tree`
     // materialises the staged index as a real tree object, so every check that
     // diffs baseSha..headSha sees exactly the staged changes — no per-check code.
-    if (opts.staged) {
+    if (plan.kind === 'staged') {
         try {
             const head = (await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
             const tree = (await (0, execa_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
-            return { baseSha: head, headSha: tree };
+            return { baseSha: head, headSha: tree, scope: 'staged' };
         }
         catch {
-            return {};
+            return { scope: 'full (no staged range)' };
         }
     }
-    if (opts.baseSha || opts.headSha) {
-        return { baseSha: opts.baseSha, headSha: opts.headSha };
+    if (plan.kind === 'explicit') {
+        return { baseSha: plan.baseSha, headSha: plan.headSha, scope: 'delta (explicit)' };
     }
     let headSha;
     try {
@@ -52,30 +83,32 @@ async function resolveDiffRange(cwd, opts) {
         headSha = stdout.trim();
     }
     catch {
-        return {};
+        return { scope: 'full (no HEAD)' };
     }
     // GitHub Actions: the PR event payload carries the base branch SHA. Read it
     // directly so delta works without relying on any client-set variable
     // (GITHUB_EVENT_* are injected by the runner).
-    if (process.env.GITHUB_EVENT_NAME === 'pull_request' && process.env.GITHUB_EVENT_PATH) {
+    if (plan.kind === 'github-event') {
         try {
             const event = JSON.parse(node_fs_1.default.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf-8'));
             const eventBase = event?.pull_request?.base?.sha;
             // Only use it if the commit is actually present in this clone; otherwise
             // fall through so a shallow clone degrades to a full scan, not 0 files.
-            const baseSha = eventBase ? await resolveRef(cwd, eventBase) : undefined;
+            const baseSha = eventBase ? await (0, utils_1.resolveGitRef)(cwd, eventBase) : undefined;
             if (baseSha)
-                return { baseSha, headSha };
+                return { baseSha, headSha, scope: 'delta (PR event)' };
         }
         catch {
-            // Malformed/unreadable event — fall through to the git-based resolution.
+            // Malformed/unreadable event — fall through to a full scan below.
         }
+        return { headSha, scope: 'full (PR base unavailable)' };
     }
-    // Bitbucket exposes the PR destination branch as an env var (also runner-set).
-    const bitbucketTarget = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
-    const ref = bitbucketTarget ? `origin/${bitbucketTarget}` : 'HEAD^';
-    const baseSha = await resolveRef(cwd, ref);
-    return { baseSha, headSha };
+    const baseSha = await (0, utils_1.resolveGitRef)(cwd, plan.ref);
+    return {
+        baseSha,
+        headSha,
+        scope: baseSha ? `delta (${plan.ref}, ${plan.reason})` : `full (${plan.ref} unresolvable)`,
+    };
 }
 /**
  * Assemble the shared CheckContext once per run. Language detection is skipped
@@ -84,9 +117,15 @@ async function resolveDiffRange(cwd, opts) {
 async function buildContext(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const config = opts.config ?? (0, loader_1.loadProjectConfig)();
-    const languages = opts.languages ?? (await (0, detect_language_1.detectLanguages)(cwd));
-    const { baseSha, headSha } = await resolveDiffRange(cwd, opts);
-    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false}`);
+    // Detection reads the client's `ignoreDirs` from the config already loaded here,
+    // rather than calling getIgnoredDirs() — that one resolves against process.cwd(),
+    // which is not necessarily the `cwd` under review.
+    const languages = opts.languages ?? (await (0, detect_language_1.detectLanguages)(cwd, config.ignoreDirs));
+    const { baseSha, headSha, scope } = await resolveDiffRange(cwd, opts);
+    // `scope` is logged because it decides what the whole run looks at, and getting
+    // it wrong is invisible in the results: a run that reviewed one commit and one
+    // that reviewed the repository both just print passes.
+    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false} scope=${scope}`);
     return {
         cwd,
         languages,

package/dist/core/targets.js

@@ -27,7 +27,7 @@ function excludeIgnoredDirs(files, keepDirs = []) {
         ignored.delete(dir);
     if (ignored.size === 0)
         return files;
-    return files.filter(f => !f.split('/').some(segment => ignored.has(segment)));
+    return files.filter(f => !(0, utils_1.isUnderIgnoredDir)(f, ignored));
 }
 /**
  * Lists the files a language check should operate on, matched by pathspec `globs`

package/dist/core/types.d.ts

@@ -90,6 +90,15 @@ export interface RunOptions {
      * (`git write-tree`), so every delta-aware check works unchanged.
      */
     staged?: boolean;
+    /**
+     * Review every tracked file instead of a diff (`--full` on the CLI, and the
+     * default when no CI environment is detected). Takes precedence over every other
+     * range source, including CI variables — see `planDiffRange`. The 16 checks that
+     * are about a diff by definition (PR Size, Diff Security, Merge Conflict, …) gate
+     * their own `applies` on `baseSha`, so they drop out of the report rather than
+     * misreporting.
+     */
+    full?: boolean;
 }
 export interface CheckReport {
     results: CheckResult[];

package/dist/init.js

@@ -11,20 +11,6 @@ const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("./config");
 const utils_1 = require("./utils");
 const CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
-/**
- * Load the canonical default ESLint rules (the same set eslint.config.mjs
- * applies) so the generated pr-checkmate.json lists every rule for the user to
- * change or disable. Falls back to an empty object if the file is unavailable.
- */
-function loadDefaultEslintRules() {
-    try {
-        return JSON.parse(fs_1.default.readFileSync((0, config_1.getPackageConfigPath)('eslint-default-rules.json'), 'utf-8'));
-    }
-    catch (err) {
-        utils_1.logger.warn(`[init]: ⚠️ Could not load default ESLint rules: ${err}`);
-        return {};
-    }
-}
 /**
  * Default configuration structure with customization options
  */
@@ -48,10 +34,22 @@ const DEFAULT_CONFIG = {
     // Directories excluded from every check (matched on any path segment). Edit
     // freely — add your own generated/vendored dirs or remove ones you want scanned.
     ignoreDirs: config_1.IGNORED_DIRS,
-    // ESLint — the full default rule set is written out so every rule is visible
-    // and editable. Change any value, or set a rule to "off" to disable it.
+    // ESLint — `rules` starts EMPTY on purpose and holds overrides only, each merged
+    // over the bundled default for that one rule.
+    //
+    // It used to be written out in full (all 27 rules with their severities) so every
+    // rule was visible and editable in this file. That copy then won over the bundled
+    // defaults forever: `eslint.rules` is in REPLACED_OBJECT_PATHS, so a later `init`
+    // keeps the user's block wholesale, and improvements to the defaults never reached
+    // a repo that had ever run `init`. Downgrading `prettier/prettier` from error to
+    // warn — so formatting stops failing pipelines — is exactly such an improvement,
+    // and it stopped at the config boundary for every existing client.
+    //
+    // The full list with defaults lives in the ESLint check documentation and in the
+    // package's own eslint-default-rules.json; discoverability there costs nothing,
+    // un-updatable defaults cost every client an edit.
     eslint: {
-        rules: loadDefaultEslintRules(),
+        rules: {},
         ignorePatterns: [],
     },
     // Prettier customization

package/dist/interfaces/index.d.ts

@@ -61,6 +61,7 @@ export interface PRCheckMateConfig {
         gitleaks?: {
             enabled?: boolean;
             version?: string;
+            depth?: number;
         };
         'npm-audit'?: {
             enabled?: boolean;

package/dist/utils/ci.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;

package/dist/utils/ci.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCiEnvironment = isCiEnvironment;
+/**
+ * Environment variables that mean "this is an automated build". `CI` alone covers
+ * GitHub Actions, GitLab, Bitbucket, CircleCI, Buildkite, Travis and most others;
+ * the rest are providers that either predate the convention or set only their own
+ * marker (Jenkins, TeamCity, Azure Pipelines, AWS CodeBuild).
+ *
+ * This answers a different question from `detectPlatform()` in reporters.ts, which
+ * picks WHERE to post a PR comment and therefore only knows the three platforms we
+ * can comment on. A Jenkins build is CI but has nowhere to post.
+ */
+const CI_ENV_VARS = [
+    'CI',
+    'GITHUB_ACTIONS',
+    'GITLAB_CI',
+    'BITBUCKET_BUILD_NUMBER',
+    'JENKINS_URL',
+    'TEAMCITY_VERSION',
+    'TF_BUILD',
+    'CIRCLECI',
+    'BUILDKITE',
+    'CODEBUILD_BUILD_ID',
+];
+/** Values that are present but mean "no" — some tooling exports `CI=false`. */
+const FALSY = new Set(['', '0', 'false', 'no', 'off']);
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+function isCiEnvironment(env = process.env) {
+    return CI_ENV_VARS.some(name => {
+        const value = env[name];
+        return value !== undefined && !FALSY.has(value.trim().toLowerCase());
+    });
+}

package/dist/utils/detect-language.d.ts

@@ -4,7 +4,12 @@ export type Language = 'typescript' | 'javascript' | 'python' | 'cpp' | 'swift'
  * with tracked source-file counts (breadth). A language is reported when it has a
  * marker file OR at least one tracked source file.
  *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
  * @returns languages ordered by tracked file count (most-used first). `.h` headers
  *   are intentionally excluded from the C++ count since they are ambiguous with C.
  */
-export declare function detectLanguages(root?: string): Promise<Language[]>;
+export declare function detectLanguages(root?: string, ignoreDirs?: string[]): Promise<Language[]>;