pr-checkmate 1.23.21 → 1.23.23

package/eslint-default-rules.json

@@ -34,18 +34,6 @@
     }
   ],
   "import/no-duplicates": "error",
-  "jsdoc/require-jsdoc": [
-    "warn",
-    {
-      "publicOnly": true,
-      "require": {
-        "FunctionDeclaration": true,
-        "MethodDefinition": true,
-        "ClassDeclaration": true,
-        "ArrowFunctionExpression": false
-      }
-    }
-  ],
   "jsdoc/check-param-names": "warn",
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",

package/eslint.config.mjs

@@ -26,6 +26,28 @@ import jsdocPlugin from 'eslint-plugin-jsdoc';
  * `eslint.rules: { "prettier/prettier": "error" }` or
  * `severity: { "Prettier": "error" }` in pr-checkmate.json.
  *
+ * FIXERS THAT FABRICATE CONTENT ARE NOT SHIPPED. `jsdoc/require-jsdoc` used to be in
+ * this set at `warn`, and it is auto-fixable — but unlike `prettier/prettier`, whose
+ * fixer produces the right answer, this one has no answer to produce. It writes an
+ * empty stub:
+ *
+ *     \/**
+ *      *
+ *      *\/
+ *
+ * which satisfies the rule permanently. The check runs in write mode by default
+ * outside CI, so one run stamped 150 stubs across one client's `src` and reported zero
+ * warnings; inside CI the auto-format commit pushes them back to the branch, so
+ * deleting them by hand never holds. The rule therefore reported a real gap once, and
+ * from then on guaranteed that every public method looked documented while none of it
+ * was — the signal destroyed by the same run that raised it.
+ *
+ * Whether a method is worth explaining is a judgement a fixer cannot make. The three
+ * `jsdoc/check-*` rules stay: they validate docblocks that already exist and fix only
+ * within them, so they never invent content. Documentation coverage, if a repo wants
+ * to enforce it, belongs in review — or in `eslint.rules` of its own pr-checkmate.json,
+ * where whoever turns it on knows what the fixer will do.
+ *
  * A JSON file cannot carry this note, hence it lives here; `src/config/.eslintrc.js`
  * holds the same rule set for the legacy ESLint <9 path and must stay in sync.
  */
@@ -100,6 +122,24 @@ const customIgnoresCount = (userConfig.eslint?.ignorePatterns || []).length;
 if (customRulesCount > 0) {
   console.error(`Applied ${customRulesCount} custom ESLint rules`);
 }
+
+// A `pr-checkmate.json` written by an older `init` contains a VERBATIM COPY of the
+// bundled rule set — all of it, severities included. Client rules merge on top of
+// the defaults, so that copy silently pins every severity forever: a repo in this
+// state keeps failing on `prettier/prettier: error` long after the bundled default
+// became `warn`, and nothing in the output says why. Detected by rule NAMES rather
+// than values (nobody hand-writes exactly this list), and reported where the person
+// reading a failed lint run will actually see it.
+const defaultRuleNames = Object.keys(defaultRules);
+const userRuleNames = Object.keys(userConfig.eslint?.rules || {});
+if (defaultRuleNames.every(name => userRuleNames.includes(name))) {
+  console.error(
+    `⚠️  eslint.rules in pr-checkmate.json lists all ${defaultRuleNames.length} built-in rules — ` +
+      'a copy written by an older `init`. It overrides the bundled defaults, so updates to them ' +
+      '(formatting is advisory since 1.23.21) never reach this repo. Delete the block to track ' +
+      'the defaults again, or keep it to pin these severities deliberately.',
+  );
+}
 if (customIgnoresCount > 0) {
   console.error(`🚫 Applied ${customIgnoresCount} custom ignore patterns`);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.21",
-    "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
+    "version": "1.23.23",
+    "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
         "pull-request",
@@ -120,8 +120,8 @@
         "tar": "7.5.22",
         "axios": "1.18.1",
         "form-data": "4.0.6",
-        "brace-expansion": "5.0.8",
-        "fast-uri": "4.1.1",
+        "brace-expansion": "5.0.9",
+        "fast-uri": "4.1.2",
         "follow-redirects": "1.16.0",
         "lodash": "4.18.1",
         "minimatch": "10.2.5",

package/src/config/.eslintrc.js

@@ -93,19 +93,9 @@ module.exports = {
       },
     ],
     'import-x/no-duplicates': 'error',
-    // Documentation (#62)
-    'jsdoc/require-jsdoc': [
-      'warn',
-      {
-        publicOnly: true,
-        require: {
-          FunctionDeclaration: true,
-          MethodDefinition: true,
-          ClassDeclaration: true,
-          ArrowFunctionExpression: false,
-        },
-      },
-    ],
+    // Documentation (#62). `jsdoc/require-jsdoc` is deliberately absent — see the
+    // note in eslint-flat-config.mjs. These three check docblocks that exist and
+    // fix only inside them; they never fabricate one.
     'jsdoc/check-param-names': 'warn',
     'jsdoc/check-tag-names': 'warn',
     'jsdoc/check-types': 'warn',