pr-checkmate 1.23.20 → 1.23.22

package/dist/utils/detect-language.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectLanguages = detectLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../config/constants");
 const execa_1 = require("./execa");
 const glob_1 = require("./glob");
 const logger_1 = require("./logger");
@@ -70,7 +71,7 @@ function hasMarker(root, lang) {
  * when git is unavailable or the directory is not a repo — callers then fall
  * back to marker files alone.
  */
-async function countTrackedFiles(root) {
+async function countTrackedFiles(root, ignoreDirs) {
     const counts = {
         typescript: 0,
         javascript: 0,
@@ -87,9 +88,18 @@ async function countTrackedFiles(root) {
     try {
         const { stdout } = await (0, execa_1.execa)('git', ['ls-files'], { cwd: root });
         const files = stdout.split('\n').map(f => f.trim());
+        const ignored = new Set(ignoreDirs);
         for (const file of files) {
             if (!file)
                 continue;
+            // A repository that commits its dependencies (`node_modules`, `vendor`,
+            // `third_party`) would otherwise be detected as a Python/Go/PHP project off
+            // the back of files nobody in it wrote, switching on whole toolchains for
+            // languages absent from the source. Detection has to describe the repo's own
+            // code, since it decides which checks run at all — the same exclusion every
+            // check's file list already applies via `excludeIgnoredDirs`.
+            if ((0, glob_1.isUnderIgnoredDir)(file, ignored))
+                continue;
             const ext = node_path_1.default.extname(file).toLowerCase();
             for (const lang of Object.keys(EXTENSIONS)) {
                 if (EXTENSIONS[lang].includes(ext)) {
@@ -109,11 +119,16 @@ async function countTrackedFiles(root) {
  * with tracked source-file counts (breadth). A language is reported when it has a
  * marker file OR at least one tracked source file.
  *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
  * @returns languages ordered by tracked file count (most-used first). `.h` headers
  *   are intentionally excluded from the C++ count since they are ambiguous with C.
  */
-async function detectLanguages(root = process.cwd()) {
-    const counts = await countTrackedFiles(root);
+async function detectLanguages(root = process.cwd(), ignoreDirs = constants_1.IGNORED_DIRS) {
+    const counts = await countTrackedFiles(root, ignoreDirs);
     const detected = Object.keys(EXTENSIONS).filter(lang => hasMarker(root, lang) || counts[lang] > 0);
     detected.sort((a, b) => counts[b] - counts[a]);
     const countStr = Object.keys(counts).map(l => `${l}=${counts[l]}`).join(', ');

package/dist/utils/git.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+export declare function resolveGitRef(cwd: string, ref: string): Promise<string | undefined>;

package/dist/utils/git.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGitRef = resolveGitRef;
+const execa_1 = require("./execa");
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+async function resolveGitRef(cwd, ref) {
+    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
+        cwd,
+        reject: false,
+    });
+    return stdout.trim() || undefined;
+}

package/dist/utils/glob.d.ts

@@ -8,3 +8,17 @@
 export declare function globToRegExp(glob: string): RegExp;
 /** True when `file` matches any of the glob `patterns`. */
 export declare function matchesAnyGlob(file: string, patterns: string[]): boolean;
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+export declare function isUnderIgnoredDir(file: string, ignoredDirs: Iterable<string>): boolean;

package/dist/utils/glob.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.globToRegExp = globToRegExp;
 exports.matchesAnyGlob = matchesAnyGlob;
+exports.isUnderIgnoredDir = isUnderIgnoredDir;
 /**
  * Minimal glob → RegExp for path matching against config patterns. Supports `*`
  * (matches within a path segment), `**` (across segments), and a leading `** /`
@@ -23,3 +24,22 @@ function globToRegExp(glob) {
 function matchesAnyGlob(file, patterns) {
     return patterns.some(p => globToRegExp(p).test(file));
 }
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+function isUnderIgnoredDir(file, ignoredDirs) {
+    const ignored = ignoredDirs instanceof Set ? ignoredDirs : new Set(ignoredDirs);
+    if (ignored.size === 0)
+        return false;
+    return file.split('/').some(segment => ignored.has(segment));
+}

package/dist/utils/index.d.ts

@@ -6,6 +6,8 @@ export * from './direct-deps';
 export * from './detect-language';
 export * from './glob';
 export * from './update-notifier';
+export * from './ci';
+export * from './git';
 /**
  *
  */

package/dist/utils/index.js

@@ -28,6 +28,8 @@ __exportStar(require("./direct-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 __exportStar(require("./glob"), exports);
 __exportStar(require("./update-notifier"), exports);
+__exportStar(require("./ci"), exports);
+__exportStar(require("./git"), exports);
 /**
  *
  */

package/eslint-default-rules.json

@@ -13,13 +13,13 @@
   "space-before-function-paren": "off",
   "operator-linebreak": "off",
   "max-len": ["warn", { "code": 100 }],
-  "semi": ["error", "always"],
-  "quotes": ["error", "single", { "avoidEscape": true }],
-  "object-curly-spacing": ["error", "always"],
-  "space-infix-ops": "error",
-  "keyword-spacing": ["error", { "before": true, "after": true }],
+  "semi": ["warn", "always"],
+  "quotes": ["warn", "single", { "avoidEscape": true }],
+  "object-curly-spacing": ["warn", "always"],
+  "space-infix-ops": "warn",
+  "keyword-spacing": ["warn", { "before": true, "after": true }],
   "padding-line-between-statements": [
-    "error",
+    "warn",
     { "blankLine": "always", "prev": "block", "next": "*" },
     { "blankLine": "always", "prev": "*", "next": "return" }
   ],
@@ -50,7 +50,7 @@
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",
   "prettier/prettier": [
-    "error",
+    "warn",
     {
       "semi": true,
       "singleQuote": true,

package/eslint.config.mjs

@@ -12,6 +12,22 @@ import jsdocPlugin from 'eslint-plugin-jsdoc';
  * Default ESLint rules — single source of truth, shared with init.ts so the
  * pr-checkmate.json it generates lists exactly the rules applied here. Edit the
  * rules in `eslint-default-rules.json` (shipped alongside this file).
+ *
+ * SEVERITY POLICY: `error` is reserved for defects a human has to resolve —
+ * `no-debugger`, `eqeqeq`, `prefer-const`, `@typescript-eslint/no-unused-vars`,
+ * `@typescript-eslint/no-floating-promises`, `import/no-duplicates`. Everything
+ * that is purely formatting is `warn`, even
+ * though it is auto-fixable, precisely BECAUSE it is auto-fixable: ESLint exits 1
+ * on errors only, and the ESLint check maps exit 1 to a blocking failure, so an
+ * `error`-level whitespace rule turns `npx prettier --write` worth of work into a
+ * red gate on someone's PR. Formatting still gets reported — as a warning here and
+ * by the dedicated Prettier check, which has always been advisory. A repo that
+ * wants formatting to gate promotes it back with
+ * `eslint.rules: { "prettier/prettier": "error" }` or
+ * `severity: { "Prettier": "error" }` in pr-checkmate.json.
+ *
+ * A JSON file cannot carry this note, hence it lives here; `src/config/.eslintrc.js`
+ * holds the same rule set for the legacy ESLint <9 path and must stay in sync.
  */
 const require = createRequire(import.meta.url);
 export const defaultRules = require('./eslint-default-rules.json');
@@ -34,7 +50,7 @@ const defaultIgnores = [
 function loadUserConfig() {
   let currentDir = process.cwd();
   let configPath = path.join(currentDir, 'pr-checkmate.json');
-  
+
   // If running from node_modules, find project root
   if (currentDir.includes('node_modules')) {
     const parts = currentDir.split(path.sep);
@@ -44,7 +60,7 @@ function loadUserConfig() {
       configPath = path.join(currentDir, 'pr-checkmate.json');
     }
   }
-  
+
   if (fs.existsSync(configPath)) {
     try {
       const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
@@ -56,7 +72,7 @@ function loadUserConfig() {
   } else {
     console.error(`[loadUserConfig]: No pr-checkmate.json found, using defaults`);
   }
-  
+
   return { sourcePath: 'src', eslint: {} };
 }
 
@@ -84,6 +100,24 @@ const customIgnoresCount = (userConfig.eslint?.ignorePatterns || []).length;
 if (customRulesCount > 0) {
   console.error(`Applied ${customRulesCount} custom ESLint rules`);
 }
+
+// A `pr-checkmate.json` written by an older `init` contains a VERBATIM COPY of the
+// bundled rule set — all of it, severities included. Client rules merge on top of
+// the defaults, so that copy silently pins every severity forever: a repo in this
+// state keeps failing on `prettier/prettier: error` long after the bundled default
+// became `warn`, and nothing in the output says why. Detected by rule NAMES rather
+// than values (nobody hand-writes exactly this list), and reported where the person
+// reading a failed lint run will actually see it.
+const defaultRuleNames = Object.keys(defaultRules);
+const userRuleNames = Object.keys(userConfig.eslint?.rules || {});
+if (defaultRuleNames.every(name => userRuleNames.includes(name))) {
+  console.error(
+    `⚠️  eslint.rules in pr-checkmate.json lists all ${defaultRuleNames.length} built-in rules — ` +
+      'a copy written by an older `init`. It overrides the bundled defaults, so updates to them ' +
+      '(formatting is advisory since 1.23.21) never reach this repo. Delete the block to track ' +
+      'the defaults again, or keep it to pin these severities deliberately.',
+  );
+}
 if (customIgnoresCount > 0) {
   console.error(`🚫 Applied ${customIgnoresCount} custom ignore patterns`);
 }
@@ -117,4 +151,4 @@ export default [
 
     rules: mergedRules,
   },
-];
+];

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.20",
-    "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
+    "version": "1.23.22",
+    "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
         "pull-request",
@@ -51,6 +51,7 @@
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
         "test": "node --require ts-node/register --test \"src/**/*.test.ts\"",
+        "verify:tarball": "bash scripts/verify-tarball.sh",
         "security-scan": "npx pr-checkmate security",
         "clean": "rm -rf dist",
         "release": "standard-version"

package/pr-checkmate.schema.json

@@ -108,7 +108,12 @@
           "type": "object",
           "properties": {
             "enabled": { "type": "boolean" },
-            "version": { "type": "string" }
+            "version": { "type": "string" },
+            "depth": {
+              "description": "Caps the whole-repository history scan used when there is no diff range (a local run or --full) to the last N commits. Ignored in a PR run, which scans the diff range.",
+              "type": "integer",
+              "minimum": 1
+            }
           }
         },
         "npm-audit": {

package/src/config/.eslintrc.js

@@ -70,13 +70,15 @@ module.exports = {
     'space-before-function-paren': 'off',
     'operator-linebreak': 'off',
     'max-len': ['warn', { code: 100 }],
-    semi: ['error', 'always'],
-    quotes: ['error', 'single', { avoidEscape: true }],
-    'object-curly-spacing': ['error', 'always'],
-    'space-infix-ops': 'error',
-    'keyword-spacing': ['error', { before: true, after: true }],
+    // Formatting is advisory — see the note above `rules` in eslint-flat-config.mjs.
+    // Keep these in sync with src/config/eslint-default-rules.json.
+    semi: ['warn', 'always'],
+    quotes: ['warn', 'single', { avoidEscape: true }],
+    'object-curly-spacing': ['warn', 'always'],
+    'space-infix-ops': 'warn',
+    'keyword-spacing': ['warn', { before: true, after: true }],
     'padding-line-between-statements': [
-      'error',
+      'warn',
       { blankLine: 'always', prev: 'block', next: '*' },
       { blankLine: 'always', prev: '*', next: 'return' },
     ],
@@ -108,7 +110,7 @@ module.exports = {
     'jsdoc/check-tag-names': 'warn',
     'jsdoc/check-types': 'warn',
     'prettier/prettier': [
-      'error',
+      'warn',
       {
         semi: true,
         singleQuote: true,