pr-checkmate 1.23.24 → 2.0.0

package/dist/core/checks/quality/spellcheck.d.ts

@@ -24,4 +24,54 @@ export declare function anchorIgnoreGlob(pattern: string): string;
  * a client writing `"en"` means exactly that and appending would be meaningless.
  */
 export declare function mergeCspellConfig(defaultConfig: CspellConfig, userConfig: Partial<CspellConfig>): CspellConfig;
+/**
+ * The optional dictionaries this installation actually has — and what to do
+ * about the ones it does not.
+ *
+ * Dropping a dictionary must not turn into a flood of warnings: a repository
+ * with Russian comments would report every Russian word as a misspelling, which
+ * is worse than the ~9 MB the dictionaries cost. So for the languages written in
+ * a script of their own, absence suppresses that script instead: cspell cannot
+ * judge those words, and reporting words it cannot judge is noise, not coverage.
+ *
+ * Latin-script languages (French, Spanish) have no such escape — their words are
+ * indistinguishable from misspelled English — so their absence is only logged,
+ * with the command that restores them.
+ *
+ * @returns imports and language codes to enable, ignore patterns for scripts left
+ *   without a dictionary, and the packages a client may want to install.
+ */
+export declare function availableDictionaries(resolve?: (id: string) => string): {
+    imports: string[];
+    languages: string[];
+    ignoreRegExpList: string[];
+    absent: string[];
+};
+/**
+ * Turn config imports into absolute paths, dropping the ones that are not installed.
+ *
+ * An unresolvable `import` is not a soft failure in cspell: it aborts config
+ * loading, checks **zero files**, and exits 1 — which this check would then have
+ * reported as "spelling issues found", a warning about problems that do not exist
+ * on a run that examined nothing. Passing the raw string through and hoping cspell
+ * copes is therefore the one thing that must not happen.
+ *
+ * @returns the imports that resolved, plus the language codes left without a
+ *   dictionary so the caller can drop them from `language`.
+ */
+export declare function resolveImports(imports: string[], baseDir: string, resolve?: (id: string) => string): {
+    resolved: string[];
+    missing: Array<{
+        pkg: string;
+        lang?: string;
+    }>;
+};
+/**
+ * Drop language codes whose dictionary is absent.
+ *
+ * Leaving `ru` in `language` with no Russian dictionary does not spellcheck
+ * Russian — it reports every Russian word as a misspelling. Having no opinion is
+ * the honest outcome when the dictionary that would form one is not installed.
+ */
+export declare function dropMissingLanguages(language: string, missing: string[]): string;
 export declare const spellcheckCheck: Check;

package/dist/core/checks/quality/spellcheck.js

@@ -6,6 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.spellcheckCheck = void 0;
 exports.anchorIgnoreGlob = anchorIgnoreGlob;
 exports.mergeCspellConfig = mergeCspellConfig;
+exports.availableDictionaries = availableDictionaries;
+exports.resolveImports = resolveImports;
+exports.dropMissingLanguages = dropMissingLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../../../config");
@@ -55,6 +58,10 @@ function mergeCspellConfig(defaultConfig, userConfig) {
     return {
         ...defaultConfig,
         language: userConfig.language || defaultConfig.language,
+        // Appended, so a client can point at a dictionary they installed themselves
+        // without losing the bundled ones. Anything that does not resolve is dropped
+        // later rather than passed to cspell, which would abort the whole run.
+        import: [...(defaultConfig.import ?? []), ...(userConfig.import ?? [])],
         words: [...defaultConfig.words, ...(userConfig.words || [])],
         // Client globs are anchored too — a repo's own pattern is meant to be relative
         // to that repo, never to whatever directories sit above the checkout.
@@ -66,25 +73,145 @@ function mergeCspellConfig(defaultConfig, userConfig) {
         ...(dictionaries.length > 0 ? { dictionaries } : {}),
     };
 }
+/**
+ * Non-English dictionaries the package no longer installs, and the language code
+ * each one serves.
+ *
+ * They used to be hard dependencies and cost every client ~9 MB on every install,
+ * to spellcheck languages almost none of them write. They are still *supported*:
+ * {@link availableDictionaries} enables one the moment it resolves, so a client
+ * who wants Russian back runs `npm i -D @cspell/dict-ru_ru` and edits no config.
+ *
+ * They are added at runtime rather than left in the bundled `cspell.json`,
+ * because a config that references an uninstalled dictionary is not a degraded
+ * config — see {@link resolveImports} — it is a broken one.
+ */
+const OPTIONAL_DICTIONARIES = [
+    { pkg: '@cspell/dict-ru_ru/cspell-ext.json', lang: 'ru', script: 'Cyrillic' },
+    { pkg: '@cspell/dict-uk-ua/cspell-ext.json', lang: 'uk', script: 'Cyrillic' },
+    { pkg: '@cspell/dict-he/cspell-ext.json', lang: 'he', script: 'Hebrew' },
+    { pkg: '@cspell/dict-fr-fr/cspell-ext.json', lang: 'fr' },
+    { pkg: '@cspell/dict-es-es/cspell-ext.json', lang: 'es' },
+];
+/**
+ * The optional dictionaries this installation actually has — and what to do
+ * about the ones it does not.
+ *
+ * Dropping a dictionary must not turn into a flood of warnings: a repository
+ * with Russian comments would report every Russian word as a misspelling, which
+ * is worse than the ~9 MB the dictionaries cost. So for the languages written in
+ * a script of their own, absence suppresses that script instead: cspell cannot
+ * judge those words, and reporting words it cannot judge is noise, not coverage.
+ *
+ * Latin-script languages (French, Spanish) have no such escape — their words are
+ * indistinguishable from misspelled English — so their absence is only logged,
+ * with the command that restores them.
+ *
+ * @returns imports and language codes to enable, ignore patterns for scripts left
+ *   without a dictionary, and the packages a client may want to install.
+ */
+function availableDictionaries(resolve = require.resolve) {
+    const imports = [];
+    const languages = [];
+    const scripts = new Set();
+    const absent = [];
+    for (const { pkg, lang, script } of OPTIONAL_DICTIONARIES) {
+        try {
+            imports.push(resolve(pkg));
+            languages.push(lang);
+        }
+        catch {
+            absent.push(pkg.split('/cspell-ext.json')[0]);
+            if (script)
+                scripts.add(script);
+        }
+    }
+    // A script is only suppressed when NO dictionary covering it survived: with
+    // Russian installed and Ukrainian missing, Cyrillic is still checked.
+    const covered = new Set(OPTIONAL_DICTIONARIES.filter(d => d.script && languages.includes(d.lang)).map(d => d.script));
+    return {
+        imports,
+        languages,
+        ignoreRegExpList: [...scripts]
+            .filter(script => !covered.has(script))
+            .map(script => `/\\p{Script=${script}}+/gu`),
+        absent,
+    };
+}
+/**
+ * Turn config imports into absolute paths, dropping the ones that are not installed.
+ *
+ * An unresolvable `import` is not a soft failure in cspell: it aborts config
+ * loading, checks **zero files**, and exits 1 — which this check would then have
+ * reported as "spelling issues found", a warning about problems that do not exist
+ * on a run that examined nothing. Passing the raw string through and hoping cspell
+ * copes is therefore the one thing that must not happen.
+ *
+ * @returns the imports that resolved, plus the language codes left without a
+ *   dictionary so the caller can drop them from `language`.
+ */
+function resolveImports(imports, baseDir, resolve = require.resolve) {
+    const resolvedPaths = [];
+    const missing = [];
+    for (const entry of imports) {
+        // A relative path comes from our own bundled config; it ships with the
+        // package and is resolved against it, not against the client's cwd.
+        if (entry.startsWith('.')) {
+            resolvedPaths.push(node_path_1.default.resolve(baseDir, entry));
+            continue;
+        }
+        try {
+            resolvedPaths.push(resolve(entry));
+        }
+        catch {
+            missing.push({
+                pkg: entry,
+                lang: OPTIONAL_DICTIONARIES.find(d => entry.startsWith(d.pkg))?.lang,
+            });
+        }
+    }
+    return { resolved: resolvedPaths, missing };
+}
+/**
+ * Drop language codes whose dictionary is absent.
+ *
+ * Leaving `ru` in `language` with no Russian dictionary does not spellcheck
+ * Russian — it reports every Russian word as a misspelling. Having no opinion is
+ * the honest outcome when the dictionary that would form one is not installed.
+ */
+function dropMissingLanguages(language, missing) {
+    const kept = language
+        .split(',')
+        .map(code => code.trim())
+        .filter(code => code && !missing.includes(code));
+    // `en` is the floor: a config with an empty `language` makes cspell fall back
+    // to its own default, which is not necessarily what was configured here.
+    return kept.length > 0 ? kept.join(',') : 'en';
+}
 function createTempCspellConfig(cwd) {
     const packageConfigPath = (0, config_1.getPackageConfigPath)('cspell.json');
     const packageConfigDir = node_path_1.default.dirname(packageConfigPath);
     const defaultConfig = JSON.parse(node_fs_1.default.readFileSync(packageConfigPath, 'utf-8'));
     const userConfig = loadUserCspellConfig(cwd);
-    // Resolve import paths to absolute so they work from any client cwd.
-    const resolvedImports = (defaultConfig.import ?? []).map(p => {
-        if (p.startsWith('.'))
-            return node_path_1.default.resolve(packageConfigDir, p);
-        try {
-            return require.resolve(p);
-        }
-        catch {
-            return p;
-        }
-    });
+    const merged = mergeCspellConfig(defaultConfig, userConfig);
+    const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir);
+    const available = availableDictionaries();
+    for (const { pkg } of missing) {
+        utils_1.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
+    }
+    if (available.absent.length > 0) {
+        utils_1.logger.debug(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
+            `Install any of them to spellcheck that language (\`npm i -D ${available.absent[0]}\`).`);
+    }
+    // A language the client asked for whose dictionary is absent is dropped rather
+    // than left in place: without the dictionary, "ru" does not spellcheck Russian,
+    // it reports every Russian word as a misspelling.
+    const requested = dropMissingLanguages(merged.language, OPTIONAL_DICTIONARIES.map(d => d.lang).filter(lang => !available.languages.includes(lang)));
     const mergedConfig = {
-        ...mergeCspellConfig(defaultConfig, userConfig),
-        import: resolvedImports,
+        ...merged,
+        language: [...new Set([...requested.split(','), ...available.languages])].join(','),
+        import: [...resolved, ...available.imports],
+        ignoreRegExpList: [...merged.ignoreRegExpList, ...available.ignoreRegExpList],
     };
     const tempConfigPath = node_path_1.default.join(cwd, '.cspell.temp.json');
     node_fs_1.default.writeFileSync(tempConfigPath, JSON.stringify(mergedConfig, null, 2));
@@ -93,6 +220,7 @@ function createTempCspellConfig(cwd) {
 exports.spellcheckCheck = {
     name: 'Spellcheck',
     phase: 'informational',
+    weight: 'heavy',
     /**
      * Clients turn the check off with `cspell.enabled: false` (or the `spellcheck`
      * alias the config interface uses). The universal `severity: { Spellcheck: "off" }`

package/dist/core/checks/quality/yaml-lint.js

@@ -83,10 +83,15 @@ exports.yamlLintCheck = {
             // so a single malformed file cannot abort the whole check.
             const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true });
             for (const doc of docs) {
-                for (const problem of [...doc.errors, ...doc.warnings].filter(isFileDefect)) {
+                const problems = [
+                    ...doc.errors.map(p => ({ problem: p, blocking: true })),
+                    ...doc.warnings.map(p => ({ problem: p, blocking: false })),
+                ].filter(({ problem }) => isFileDefect(problem));
+                for (const { problem, blocking } of problems) {
                     const pos = problem.linePos?.[0];
                     issues.push({
                         file,
+                        blocking,
                         line: pos?.line,
                         col: pos?.col,
                         message: shortMessage(problem.message),
@@ -96,15 +101,23 @@ exports.yamlLintCheck = {
         }
         if (issues.length === 0)
             return (0, types_1.pass)();
-        // YAML problems are a hard error by default; a repo may downgrade to `warn`
-        // via `yamlLint.severity`.
-        const sev = (0, findings_1.severityEmitter)(ctx.config.yamlLint?.severity, 'error');
-        issues.slice(0, 10).forEach(i => {
-            const where = i.line ? `:${i.line}${i.col ? `:${i.col}` : ''}` : '';
-            sev.log(`[YAML Lint]: ${sev.icon} ${i.file}${where} — ${i.message}`);
-        });
+        // A file that does not parse blocks; a file that parses and merely worries
+        // the parser does not. Treating both as blocking is what made this check
+        // feel like an obstacle rather than a gate — and a check people switch off
+        // protects nobody. `yamlLint.severity` still overrides both at once.
+        const configured = ctx.config.yamlLint?.severity;
+        const broken = issues.filter(i => i.blocking);
+        const questionable = issues.filter(i => !i.blocking);
+        const describe = (i) => `${i.file}${i.line ? `:${i.line}${i.col ? `:${i.col}` : ''}` : ''} — ${i.message}`;
+        const sev = (0, findings_1.severityEmitter)(configured, broken.length > 0 ? 'error' : 'warn');
+        [...broken, ...questionable]
+            .slice(0, 10)
+            .forEach(i => sev.log(`[YAML Lint]: ${sev.icon} ${describe(i)}`));
         if (issues.length > 10)
             sev.log(`[YAML Lint]:   ... and ${issues.length - 10} more`);
-        return sev.emit(`${issues.length} YAML issue(s) found`);
+        const summary = broken.length > 0 && questionable.length > 0
+            ? `${broken.length} unparseable, ${questionable.length} questionable YAML issue(s)`
+            : `${issues.length} YAML issue(s) found`;
+        return sev.emit(summary);
     },
 };

package/dist/core/checks/security/diff-security.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSecurityCheck = void 0;
 const utils_1 = require("../../../utils");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 const findings_1 = require("../findings");
 const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
@@ -10,35 +11,48 @@ const SECURITY_PATTERNS = [
     {
         pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
         label: 'dangerouslySetInnerHTML (XSS risk)',
+        view: 'code',
         severity: 'error',
     },
     {
         pattern: /^\+(?!\+).*\.innerHTML\s*=/,
         label: 'innerHTML assignment (XSS risk)',
+        view: 'code',
         severity: 'warn',
     },
     {
         pattern: /^\+(?!\+).*document\.write\s*\(/,
         label: 'document.write() (XSS risk)',
+        view: 'code',
         severity: 'error',
     },
     {
-        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
+        // Matched against the string-blanked view, so unrelated quoting on the line
+        // cannot disable the rule. The old lookahead `(?![^'"`]*['"`])` meant "no
+        // quote anywhere ahead", which silently skipped `eval(x + "y")` and
+        // ``eval(`${p}`)`` — see ticket 058.
+        pattern: /^\+(?!\+).*\beval\s*\(/,
         label: 'eval() (code injection risk)',
         severity: 'error',
+        view: 'code',
     },
     {
         pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
         label: 'new Function() (code injection risk)',
         severity: 'error',
+        view: 'code',
     },
     {
-        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
+        // Both the property form (`o.__proto__ =`, `{ __proto__: … }`) and the
+        // computed form (`o['__proto__'] =`). The latter is the one that survives a
+        // grep for `.__proto__`, and the one an attacker-supplied key arrives through.
+        // The rule matches its own source, hence the opt-out on the line itself.
+        pattern: /^\+(?!\+).*(?:__proto__\s*[=:[]|\[\s*['"]__proto__['"]\s*\])/, // pr-checkmate-ignore
         label: '__proto__ mutation (prototype pollution)',
         severity: 'error',
     },
     {
-        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
+        pattern: /^\+(?!\+).*(?:\.constructor\.prototype\b|\[\s*['"]constructor['"]\s*\]\s*\[\s*['"]prototype['"]\s*\])/,
         label: 'constructor.prototype access (prototype pollution)',
         severity: 'warn',
     },
@@ -55,11 +69,13 @@ const SECURITY_PATTERNS = [
     {
         pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
         label: 'deprecated createDecipher() — use createDecipheriv()',
+        view: 'code',
         severity: 'warn',
     },
     {
         pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
         label: 'deprecated createCipher() — use createCipheriv()',
+        view: 'code',
         severity: 'warn',
     },
     {
@@ -103,8 +119,18 @@ const SECURITY_PATTERNS = [
 ];
 /** Python-specific dangerous constructs, scanned in *.py diffs. */
 const PYTHON_SECURITY_PATTERNS = [
-    { pattern: /^\+(?!\+).*\beval\s*\(/, label: 'eval() (code injection risk)', severity: 'error' },
-    { pattern: /^\+(?!\+).*\bexec\s*\(/, label: 'exec() (code injection risk)', severity: 'error' },
+    {
+        pattern: /^\+(?!\+).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+        view: 'code',
+    },
+    {
+        pattern: /^\+(?!\+).*\bexec\s*\(/,
+        label: 'exec() (code injection risk)',
+        severity: 'error',
+        view: 'code',
+    },
     {
         pattern: /^\+(?!\+).*\bos\.system\s*\(/,
         label: 'os.system() (command injection risk)',
@@ -209,49 +235,106 @@ const KOTLIN_SECURITY_PATTERNS = [
     },
 ];
 const JS_GLOBS = ['*.ts', '*.tsx', '*.js', '*.jsx', '*.mjs', '*.cjs'];
-/** Scan a diff with a pattern set, accumulating matches into severity buckets. */
-function scanInto(stdout, patterns, errors, warnings) {
-    for (const line of stdout.split('\n')) {
-        // Match against the comment-stripped line so `eval(x)` in a comment isn't
-        // flagged, but report the original line for context.
-        const scanned = (0, findings_1.stripInlineComment)(line);
-        for (const { pattern, label, severity } of patterns) {
-            if (pattern.test(scanned)) {
-                const bucket = severity === 'error' ? errors : warnings;
-                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-            }
+/**
+ * Compile the client's `extraPatterns` into the same shape as the built-ins, so
+ * a project rule gets identical treatment: comment stripping, the code/raw view,
+ * grouping, sampling and severity.
+ *
+ * A malformed regex is reported and dropped rather than thrown: one bad entry in
+ * a config file must not take down the whole security scan.
+ */
+function compileExtraPatterns(ctx) {
+    const extra = ctx.config.diffSecurity?.extraPatterns ?? [];
+    return extra.flatMap(rule => {
+        try {
+            // `g`/`y` are stripped: both carry lastIndex state across .test() calls,
+            // which would make a rule match every other line.
+            const flags = (rule.flags ?? '').replace(/[gy]/g, '');
+            return [
+                {
+                    // Anchored on the added-line marker the same way the built-ins are, so
+                    // a client writes the body of the rule, not the diff plumbing.
+                    pattern: new RegExp(`^\\+(?!\\+).*(?:${rule.pattern})`, flags),
+                    label: rule.label,
+                    severity: rule.severity ?? 'warn',
+                    view: rule.view ?? 'raw',
+                },
+            ];
         }
-    }
+        catch (err) {
+            utils_1.logger.warn(`[Diff Security]: ⚠️ ignoring extraPattern "${rule.label}" — invalid regex: ${err}`);
+            return [];
+        }
+    });
+}
+/**
+ * Built-ins minus anything the client switched off by label. `disablePatterns`
+ * differs from `ignore`: the rule never runs at all, rather than running and
+ * having its findings dropped afterwards.
+ */
+function activePatterns(patterns, disabled) {
+    if (disabled.length === 0)
+        return patterns;
+    const lowered = disabled.map(d => d.toLowerCase());
+    return patterns.filter(p => !lowered.some(d => p.label.toLowerCase().includes(d)));
 }
 exports.diffSecurityCheck = {
     name: 'Diff Security',
     phase: 'informational',
+    // No `requiresDiff`: a dangerous call is dangerous whether it arrived in this
+    // PR or three years ago, so with no diff range the whole tree is reviewed
+    // instead of the check dropping out (ticket 067).
     applies(ctx) {
-        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.diffSecurity?.enabled !== false;
     },
     async run(ctx) {
         try {
-            const errors = {};
-            const warnings = {};
+            const cfg = ctx.config.diffSecurity ?? {};
+            const found = (0, findings_1.emptyBuckets)();
+            const scanOpts = {
+                comments: cfg.commentHandling ?? 'language',
+                ignorePaths: cfg.ignorePaths,
+            };
+            const extra = compileExtraPatterns(ctx);
+            const disabled = cfg.disablePatterns ?? [];
+            const scanInto = (stdout, patterns) => {
+                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, activePatterns(patterns, disabled), scanOpts));
+            };
+            /**
+             * Feed one language's sources through the patterns, from the diff when
+             * there is one and from the files themselves otherwise. Both paths reach
+             * `scanDiffPatterns` in the same shape, so the two modes cannot disagree
+             * about what counts as a finding.
+             */
+            const review = async (globs, patterns) => {
+                if (ctx.baseSha) {
+                    scanInto(await (0, findings_1.diffAddedLines)(ctx, globs), patterns);
+                    return;
+                }
+                if (ctx.config.run?.fullScanBehaviour === 'skip')
+                    return;
+                const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.']);
+                await (0, findings_1.scanTrackedFiles)(ctx, files, asDiff => scanInto(asDiff, patterns));
+            };
             // JS/TS patterns always run; language-specific sets scan their own globs
             // only when that language is present, so a Python repo gets Python rules.
-            scanInto(await (0, findings_1.diffAddedLines)(ctx, JS_GLOBS), SECURITY_PATTERNS, errors, warnings);
+            // Client `extraPatterns` run against every scanned language, since a
+            // project rule is not tied to the built-in language split.
+            await review(JS_GLOBS, [...SECURITY_PATTERNS, ...extra]);
             if (ctx.languages.includes('python')) {
-                scanInto(await (0, findings_1.diffAddedLines)(ctx, ['*.py']), PYTHON_SECURITY_PATTERNS, errors, warnings);
+                await review(['*.py'], [...PYTHON_SECURITY_PATTERNS, ...extra]);
             }
             if (ctx.languages.includes('go')) {
-                scanInto(await (0, findings_1.diffAddedLines)(ctx, ['*.go']), GO_SECURITY_PATTERNS, errors, warnings);
+                await review(['*.go'], [...GO_SECURITY_PATTERNS, ...extra]);
             }
             if (ctx.languages.includes('kotlin')) {
-                const ktOut = await (0, findings_1.diffAddedLines)(ctx, ['*.kt', '*.kts', '*.java']);
-                scanInto(ktOut, KOTLIN_SECURITY_PATTERNS, errors, warnings);
+                await review(['*.kt', '*.kts', '*.java'], [...KOTLIN_SECURITY_PATTERNS, ...extra]);
             }
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: 'Diff Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                sampleLimit: 3,
-                ignore: ctx.config.diffSecurity?.ignore,
+                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {

package/dist/core/checks/security/dockerfile-security.js

@@ -45,26 +45,13 @@ const DOCKER_PATTERNS = [
         severity: 'warn',
     },
 ];
-function scanDiff(stdout) {
-    const errors = {};
-    const warnings = {};
-    for (const line of stdout.split('\n')) {
-        if (line.includes('pr-checkmate-ignore'))
-            continue;
-        for (const { pattern, label, severity } of DOCKER_PATTERNS) {
-            if (pattern.test(line)) {
-                const bucket = severity === 'error' ? errors : warnings;
-                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-            }
-        }
-    }
-    return { errors, warnings };
-}
 exports.dockerfileSecurityCheck = {
     name: 'Dockerfile Security',
     phase: 'informational',
+    // No `requiresDiff`: a secret baked into an ENV line is baked in whether the
+    // line is new or inherited (ticket 067).
     applies(ctx) {
-        return ctx.config.dockerfileSecurity?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.dockerfileSecurity?.enabled !== false;
     },
     async run(ctx) {
         const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
@@ -74,14 +61,30 @@ exports.dockerfileSecurityCheck = {
         if (dockerfiles.length === 0)
             return (0, types_1.pass)();
         try {
-            const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd });
-            const { errors, warnings } = scanDiff(stdout);
+            const cfg = ctx.config.dockerfileSecurity ?? {};
+            let stdout = '';
+            if (ctx.baseSha) {
+                stdout = (await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd })).stdout;
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                await (0, findings_1.scanTrackedFiles)(ctx, dockerfiles, asDiff => {
+                    stdout += `${asDiff}\n`;
+                });
+            }
+            // This check runs `git diff` itself rather than going through
+            // `diffAddedLines`, so the `pr-checkmate-ignore` opt-out is applied here.
+            const { errors, warnings } = (0, findings_1.scanDiffPatterns)(stdout, DOCKER_PATTERNS, {
+                skipIgnored: true,
+                // Dockerfiles have no extension to key off, and `#` is their comment
+                // marker — the `hash` reading, not the language-detected one.
+                comments: 'legacy',
+                ignorePaths: cfg.ignorePaths,
+            });
             return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
                 prefix: 'Dockerfile Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                sampleLimit: 3,
-                ignore: ctx.config.dockerfileSecurity?.ignore,
+                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {

package/dist/core/checks/security/migration-safety.js

@@ -65,8 +65,11 @@ function scan(stdout, findings) {
 exports.migrationSafetyCheck = {
     name: 'Migration Safety',
     phase: 'informational',
+    // No `requiresDiff`: a destructive migration is destructive whenever it was
+    // written (ticket 067). Over a whole repository this becomes an inventory of
+    // the irreversible migrations already in the history, which is worth having.
     applies(ctx) {
-        return ctx.config.migrationSafety?.enabled !== false && Boolean(ctx.baseSha);
+        return ctx.config.migrationSafety?.enabled !== false;
     },
     async run(ctx) {
         // Not sourcePath-scoped: migrations commonly live outside `src` (db/, alembic/).
@@ -79,28 +82,27 @@ exports.migrationSafetyCheck = {
         if (migrationFiles.length === 0)
             return (0, types_1.pass)();
         try {
-            const { stdout } = await (0, execa_1.execa)('git', [
-                'diff',
-                '--unified=0',
-                ctx.baseSha,
-                ctx.headSha ?? 'HEAD',
-                '--',
-                ...migrationFiles,
-            ], { cwd: ctx.cwd });
+            let stdout = '';
+            if (ctx.baseSha) {
+                stdout = (await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...migrationFiles], { cwd: ctx.cwd })).stdout;
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                await (0, findings_1.scanTrackedFiles)(ctx, migrationFiles, asDiff => {
+                    stdout += `${asDiff}\n`;
+                });
+            }
             const findings = {};
             scan(stdout, findings);
             if ((0, findings_1.bucketTotal)(findings) === 0)
                 return (0, types_1.pass)();
-            const sev = (0, findings_1.severityEmitter)(ctx.config.migrationSafety?.severity, 'warn');
-            (0, findings_1.logFindings)(findings, {
+            return (0, findings_1.reportCountedFindings)(findings, ctx, {
                 prefix: 'Migration Safety',
-                sampleLimit: 2,
-                isError: sev.icon === '❌',
+                severity: ctx.config.migrationSafety?.severity,
+                sampleLimit: ctx.config.log?.sampleLimit ?? 2,
+                // The labels carry an explanatory tail ("… — rewrites every row"); the
+                // summary is a one-line tally, so only the name of the risk fits.
+                summaryLabel: label => label.split(' — ')[0],
             });
-            const summary = Object.entries(findings)
-                .map(([label, arr]) => `${arr.length}× ${label.split(' — ')[0]}`)
-                .join(', ');
-            return sev.emit(summary);
         }
         catch (err) {
             utils_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);