pr-checkmate 1.23.24 → 2.1.0

package/dist/config/pr-checkmate-workflow.yml

@@ -1,353 +1,92 @@
-name: PR Checkmate Quality Checks
+name: PR CheckMate
 
 on:
   pull_request:
     branches: [main, master, develop]
     types: [opened, synchronize, reopened]
 
+# Least privilege. `pull-requests: write` is what lets the run upsert its summary
+# comment on the PR; drop it and the checks still run, they just report to the log.
 permissions:
-  contents: write
+  contents: read
   pull-requests: write
 
-jobs:
-  pr-checkmate-all:
-    name: PR Checkmate All Checks
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run PR Checkmate All Checks
-        run: npx pr-checkmate all
-        continue-on-error: true
-
-      - name: Auto-commit formatting changes
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -A
-          if ! git diff --cached --quiet; then
-            git commit -m "style: auto-format code with Prettier"
-            git push origin HEAD:${{ github.head_ref }}
-            echo "Formatting changes committed and pushed"
-          else
-            echo "No formatting changes needed"
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  lint:
-    name: ESLint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run ESLint
-        run: npx pr-checkmate lint
-        continue-on-error: true
-
-  prettier:
-    name: Prettier
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Prettier
-        run: npx pr-checkmate prettier
-        continue-on-error: true
-
-  spellcheck:
-    name: Spellcheck
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Spellcheck
-        run: npx pr-checkmate spellcheck
-        continue-on-error: true
-
-  security:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Security Scan
-        run: npx pr-checkmate security
-        continue-on-error: true
-
-  dependency-check:
-    name: Dependency Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Dependency Check
-        run: npx pr-checkmate dependencies
-        continue-on-error: true
-
-  circular-deps:
-    name: Circular Dependencies
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Circular Dependency Check
-        run: npx pr-checkmate circular
-        continue-on-error: true
-
-  license-check:
-    name: License Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run License Check
-        run: npx pr-checkmate license
-        continue-on-error: true
-
-  pr-size:
-    name: PR Size
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check PR Size
-        run: npx pr-checkmate pr-size
-        continue-on-error: true
-
-  pr-title:
-    name: PR Title
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check PR Title
-        run: npx pr-checkmate pr-title
-        continue-on-error: true
-
-  outdated-deps:
-    name: Outdated Dependencies
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check Outdated Dependencies
-        run: npx pr-checkmate outdated
-        continue-on-error: true
-
-  markdown-lint:
-    name: Markdown Lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+# Push three times in a minute and the first two runs become answers to questions
+# nobody is asking any more — they still hold a runner, and they still race to
+# upsert the summary comment, so a stale verdict can land on top of a fresh one.
+# Keyed per PR, so runs on different pull requests never cancel each other.
+concurrency:
+  group: pr-checkmate-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Markdown Lint
-        run: npx pr-checkmate markdown
-        continue-on-error: true
-
-  typecheck:
-    name: TypeScript Type Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run TypeScript Type Check
-        run: npx pr-checkmate typecheck
-        continue-on-error: true
-
-  diff-smell:
-    name: Diff Code Smell
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Scan Diff for Code Smells
-        run: npx pr-checkmate diff-smell
-        continue-on-error: true
-
-  pr-body:
-    name: PR Description
+jobs:
+  pr-checkmate:
+    name: PR CheckMate
     runs-on: ubuntu-latest
+    # A hung step otherwise runs to GitHub's six-hour default before anyone hears
+    # about it. Every check here has its own internal timeout; this is the backstop
+    # for the ones that cannot fail themselves — a wedged network fetch, a tool
+    # waiting on stdin. Raise it for a large monorepo.
+    timeout-minutes: 20
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          ref: ${{ github.head_ref }}
+          # Required, not optional. Without the full history the PR base commit is
+          # not in the clone, no diff range can be built, and every diff-based
+          # check — Diff Security, Workflow Security, Dockerfile Security,
+          # Sensitive Files and a dozen others — skips itself. The run then says
+          # `Scan Scope: … set fetch-depth: 0`, which is this line.
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Check PR Description
-        run: npx pr-checkmate pr-body
-        continue-on-error: true
-
-  duplicate-check:
-    name: Duplicate Code
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      # PR CheckMate fetches only the tooling this repository turns out to need
+      # (`npx pr-checkmate doctor` prints what and why). Without this step that
+      # tooling is fetched again on every run: the download shrinks, the wait
+      # does not. The key carries the pr-checkmate version, so an upgrade fetches
+      # afresh instead of reusing tooling meant for the previous one.
+      - name: Cache PR CheckMate tooling
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-          ref: ${{ github.head_ref }}
-          fetch-depth: 0
+          path: ~/.cache/pr-checkmate
+          key: pr-checkmate-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            pr-checkmate-${{ runner.os }}-
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      # Grype keeps its own vulnerability database, and it is the single largest
+      # download in the whole run: 134 MB compressed, 1.9 GB unpacked, refreshed
+      # daily upstream. Without this step every job pays for it again. The key is
+      # dated rather than content-hashed, because the thing that changes is the
+      # upstream database, not anything in this repository — a stale entry is
+      # restored by the prefix and grype updates it in place.
+      - name: Cache Grype vulnerability database
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-          node-version: 24
+          path: ~/.cache/grype
+          key: grype-db-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            grype-db-${{ runner.os }}-
 
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Check for Duplicate Code
-        run: npx pr-checkmate duplicate
-        continue-on-error: true
+      # One job runs the whole registry. Splitting it per check would repeat the
+      # checkout and install for every one of them, and the selection of what runs
+      # belongs in pr-checkmate.json (`severity`), not in copied YAML.
+      #
+      # This template is the one `init` scaffolds when pr-checkmate IS a
+      # dependency: `npm ci` above installs it, so npx runs that copy at the
+      # version your lockfile pins. A repository that does not install it gets
+      # the container variant instead, because bare `npx` would resolve to the
+      # newest release and download it on every job.
+      - name: Run PR CheckMate
+        env:
+          # Not injected automatically: without this the run cannot authenticate,
+          # and the summary comment silently never reaches the PR.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx pr-checkmate all

package/dist/core/checks/dependencies/banned-imports.js

@@ -27,41 +27,40 @@ function compileBans(ctx) {
 exports.bannedImportsCheck = {
     name: 'Banned Imports',
     phase: 'informational',
+    // No `requiresDiff`: a banned import is banned wherever it is, not only where
+    // it was just introduced (ticket 067).
     applies(ctx) {
-        return (ctx.config.bannedImports?.length ?? 0) > 0 && Boolean(ctx.baseSha);
+        return (ctx.config.bannedImports?.length ?? 0) > 0;
     },
     async run(ctx) {
-        var _a;
         const bans = compileBans(ctx);
         if (bans.length === 0)
             return (0, types_1.pass)('no banned imports configured');
         try {
-            const stdout = await (0, findings_1.diffAddedLines)(ctx, ['*']);
             const errors = {};
             const warnings = {};
-            for (const raw of stdout.split('\n')) {
-                if (!raw.startsWith('+') || raw.startsWith('+++'))
-                    continue;
-                const content = raw.slice(1);
-                for (const ban of bans) {
-                    if (ban.re.test(content)) {
-                        const bucket = ban.severity === 'error' ? errors : warnings;
-                        (bucket[_a = ban.message] ?? (bucket[_a] = [])).push(content.trim().substring(0, 100));
+            await (0, findings_1.reviewLines)(ctx, ['*'], stdout => {
+                var _a;
+                for (const raw of stdout.split('\n')) {
+                    if (!raw.startsWith('+') || raw.startsWith('+++'))
+                        continue;
+                    const content = raw.slice(1);
+                    for (const ban of bans) {
+                        if (ban.re.test(content)) {
+                            const bucket = ban.severity === 'error' ? errors : warnings;
+                            (bucket[_a = ban.message] ?? (bucket[_a] = [])).push(content.trim().substring(0, 100));
+                        }
                     }
                 }
-            }
-            const totalErrors = (0, findings_1.bucketTotal)(errors);
-            const totalWarnings = (0, findings_1.bucketTotal)(warnings);
-            if (totalErrors === 0 && totalWarnings === 0)
-                return (0, types_1.pass)();
-            (0, findings_1.logFindings)(errors, { prefix: PREFIX, isError: true, sampleLimit: 3 });
-            (0, findings_1.logFindings)(warnings, { prefix: PREFIX, sampleLimit: 3 });
-            const parts = [];
-            if (totalErrors > 0)
-                parts.push(`${totalErrors} banned (error)`);
-            if (totalWarnings > 0)
-                parts.push(`${totalWarnings} banned (warn)`);
-            return totalErrors > 0 ? (0, types_1.fail)(parts.join(', ')) : (0, types_1.warn)(parts.join(', '));
+            });
+            // A ban configured as "error" blocks the run, regardless of phase — that
+            // is the default `failOn`, and the client can still relax it per repo.
+            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+                prefix: PREFIX,
+                errorSummary: n => `${n} banned (error)`,
+                warningSummary: n => `${n} banned (warn)`,
+                ...(0, findings_1.clientFindingOptions)(ctx),
+            });
         }
         catch (err) {
             utils_1.logger.warn(`[Banned Imports]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/dependencies/circular-deps.js

@@ -73,6 +73,7 @@ function readReport(reportPath) {
 exports.circularDepsCheck = {
     name: 'Circular Deps',
     phase: 'blocking',
+    weight: 'heavy',
     applies(ctx) {
         if (ctx.config.circularDeps?.enabled === false)
             return false;

package/dist/core/checks/dependencies/dependency-check.js

@@ -102,6 +102,7 @@ function filesUsing(issues, name) {
 exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',
+    weight: 'heavy',
     applies(ctx) {
         if (ctx.config.dependency?.enabled === false)
             return false;

package/dist/core/checks/dependencies/grype-scan.js

@@ -45,6 +45,7 @@ function severityRank(severity) {
 exports.grypeScanCheck = {
     name: 'Grype Scan',
     phase: 'informational',
+    weight: 'heavy',
     applies(ctx) {
         return ctx.config.grypeScan?.enabled !== false;
     },

package/dist/core/checks/dependencies/npm-audit.js

@@ -37,7 +37,12 @@ exports.npmAuditCheck = {
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
-        const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'moderate';
+        // `high`, not `moderate`. A moderate CVE in a direct dependency often has no
+        // fix available, and blocking on it stops the team shipping anything at all —
+        // indefinitely, for a risk they have usually already accepted. A gate that
+        // cannot be satisfied gets switched off, and then the high ones stop blocking
+        // too. Clients who want the stricter line set `security.npm-audit.auditLevel`.
+        const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'high';
         const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
         const ownName = getOwnPackageName();
         const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });

package/dist/core/checks/dependencies/vuln-scan.js

@@ -19,6 +19,7 @@ const DEFAULT_TIMEOUT_MS = 120000;
 exports.vulnScanCheck = {
     name: 'Vuln Scan',
     phase: 'informational',
+    weight: 'heavy',
     applies(ctx) {
         return ctx.config.vulnScan?.enabled === true;
     },