pr-checkmate 1.23.23 → 2.0.0

package/src/config/cspell.json

@@ -1,13 +1,6 @@
 {
   "version": "0.2",
-  "language": "en,ru,uk,he,fr,es",
-  "import": [
-    "@cspell/dict-ru_ru/cspell-ext.json",
-    "@cspell/dict-uk-ua/cspell-ext.json",
-    "@cspell/dict-he/cspell-ext.json",
-    "@cspell/dict-fr-fr/cspell-ext.json",
-    "@cspell/dict-es-es/cspell-ext.json"
-  ],
+  "language": "en,en-GB",
   "words": [
     "absdiff",
     "abspath",
@@ -467,6 +460,7 @@
     "eficiente",
     "eigen",
     "EIGEN",
+    "EINTEGRITY",
     "EKNFFL",
     "elbert",
     "elementwise",
@@ -1057,6 +1051,7 @@
     "oaep",
     "Obagi",
     "objdetect",
+    "Octo",
     "octocat",
     "ohlc",
     "ohlcv",

package/src/config/pr-checkmate-workflow.yml

@@ -1,353 +1,59 @@
-name: PR Checkmate Quality Checks
+name: PR CheckMate
 
 on:
   pull_request:
     branches: [main, master, develop]
     types: [opened, synchronize, reopened]
 
+# Least privilege. `pull-requests: write` is what lets the run upsert its summary
+# comment on the PR; drop it and the checks still run, they just report to the log.
 permissions:
-  contents: write
+  contents: read
   pull-requests: write
 
 jobs:
-  pr-checkmate-all:
-    name: PR Checkmate All Checks
+  pr-checkmate:
+    name: PR CheckMate
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          ref: ${{ github.head_ref }}
+          # Required, not optional. Without the full history the PR base commit is
+          # not in the clone, no diff range can be built, and every diff-based
+          # check — Diff Security, Workflow Security, Dockerfile Security,
+          # Sensitive Files and a dozen others — skips itself. The run then says
+          # `Scan Scope: … set fetch-depth: 0`, which is this line.
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Run PR Checkmate All Checks
-        run: npx pr-checkmate all
-        continue-on-error: true
+      # PR CheckMate fetches only the tooling this repository turns out to need
+      # (`npx pr-checkmate doctor` prints what and why). Without this step that
+      # tooling is fetched again on every run: the download shrinks, the wait
+      # does not. The key carries the pr-checkmate version, so an upgrade fetches
+      # afresh instead of reusing tooling meant for the previous one.
+      - name: Cache PR CheckMate tooling
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cache/pr-checkmate
+          key: pr-checkmate-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            pr-checkmate-${{ runner.os }}-
 
-      - name: Auto-commit formatting changes
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -A
-          if ! git diff --cached --quiet; then
-            git commit -m "style: auto-format code with Prettier"
-            git push origin HEAD:${{ github.head_ref }}
-            echo "Formatting changes committed and pushed"
-          else
-            echo "No formatting changes needed"
-          fi
+      # One job runs the whole registry. Splitting it per check would repeat the
+      # checkout and install for every one of them, and the selection of what runs
+      # belongs in pr-checkmate.json (`severity`), not in copied YAML.
+      - name: Run PR CheckMate
         env:
+          # Not injected automatically: without this the run cannot authenticate,
+          # and the summary comment silently never reaches the PR.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  lint:
-    name: ESLint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run ESLint
-        run: npx pr-checkmate lint
-        continue-on-error: true
-
-  prettier:
-    name: Prettier
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Prettier
-        run: npx pr-checkmate prettier
-        continue-on-error: true
-
-  spellcheck:
-    name: Spellcheck
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Spellcheck
-        run: npx pr-checkmate spellcheck
-        continue-on-error: true
-
-  security:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Security Scan
-        run: npx pr-checkmate security
-        continue-on-error: true
-
-  dependency-check:
-    name: Dependency Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Dependency Check
-        run: npx pr-checkmate dependencies
-        continue-on-error: true
-
-  circular-deps:
-    name: Circular Dependencies
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Circular Dependency Check
-        run: npx pr-checkmate circular
-        continue-on-error: true
-
-  license-check:
-    name: License Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run License Check
-        run: npx pr-checkmate license
-        continue-on-error: true
-
-  pr-size:
-    name: PR Size
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check PR Size
-        run: npx pr-checkmate pr-size
-        continue-on-error: true
-
-  pr-title:
-    name: PR Title
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check PR Title
-        run: npx pr-checkmate pr-title
-        continue-on-error: true
-
-  outdated-deps:
-    name: Outdated Dependencies
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check Outdated Dependencies
-        run: npx pr-checkmate outdated
-        continue-on-error: true
-
-  markdown-lint:
-    name: Markdown Lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Markdown Lint
-        run: npx pr-checkmate markdown
-        continue-on-error: true
-
-  typecheck:
-    name: TypeScript Type Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run TypeScript Type Check
-        run: npx pr-checkmate typecheck
-        continue-on-error: true
-
-  diff-smell:
-    name: Diff Code Smell
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Scan Diff for Code Smells
-        run: npx pr-checkmate diff-smell
-        continue-on-error: true
-
-  pr-body:
-    name: PR Description
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check PR Description
-        run: npx pr-checkmate pr-body
-        continue-on-error: true
-
-  duplicate-check:
-    name: Duplicate Code
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check for Duplicate Code
-        run: npx pr-checkmate duplicate
-        continue-on-error: true
+        run: npx pr-checkmate all