pr-checkmate 1.23.21 → 1.23.22

package/eslint.config.mjs

@@ -100,6 +100,24 @@ const customIgnoresCount = (userConfig.eslint?.ignorePatterns || []).length;
 if (customRulesCount > 0) {
   console.error(`Applied ${customRulesCount} custom ESLint rules`);
 }
+
+// A `pr-checkmate.json` written by an older `init` contains a VERBATIM COPY of the
+// bundled rule set — all of it, severities included. Client rules merge on top of
+// the defaults, so that copy silently pins every severity forever: a repo in this
+// state keeps failing on `prettier/prettier: error` long after the bundled default
+// became `warn`, and nothing in the output says why. Detected by rule NAMES rather
+// than values (nobody hand-writes exactly this list), and reported where the person
+// reading a failed lint run will actually see it.
+const defaultRuleNames = Object.keys(defaultRules);
+const userRuleNames = Object.keys(userConfig.eslint?.rules || {});
+if (defaultRuleNames.every(name => userRuleNames.includes(name))) {
+  console.error(
+    `⚠️  eslint.rules in pr-checkmate.json lists all ${defaultRuleNames.length} built-in rules — ` +
+      'a copy written by an older `init`. It overrides the bundled defaults, so updates to them ' +
+      '(formatting is advisory since 1.23.21) never reach this repo. Delete the block to track ' +
+      'the defaults again, or keep it to pin these severities deliberately.',
+  );
+}
 if (customIgnoresCount > 0) {
   console.error(`🚫 Applied ${customIgnoresCount} custom ignore patterns`);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.21",
-    "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
+    "version": "1.23.22",
+    "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
         "pull-request",