pr-checkmate 1.23.5 → 1.23.7

package/LICENSE

@@ -36,6 +36,20 @@ Any use not expressly permitted in writing by the Owner is strictly
 prohibited and constitutes a violation of applicable copyright and
 intellectual property laws.
 
+================================================================================
+PUBLIC MIRROR EXCEPTION
+================================================================================
+
+The restrictions above do not prevent the Owner itself from publishing
+selected non-source materials — this LICENSE, the README, the CONTRIBUTING
+and CODE_OF_CONDUCT files, the documentation/ tree, and the configuration
+template and its JSON schema — to a public repository the Owner controls, for
+the sole purpose of giving consumers of the published npm package a reachable
+repository URL and readable documentation. This exception applies only to
+publication carried out by or on behalf of the Owner; it grants no rights to
+any other party to fork, mirror, re-host, or redistribute the Software, and it
+does not extend to the source code itself.
+
 ================================================================================
 NO WARRANTY
 ================================================================================

package/README.md

@@ -1,6 +1,7 @@
 # ♟️ PR CheckMate
 
-![Build](https://img.shields.io/github/actions/workflow/status/Mybono/sdk_automation/publish.yml?branch=main&label=CI&color=blue)
+[![npm](https://img.shields.io/npm/v/pr-checkmate?label=npm&color=CB3837&logo=npm&logoColor=white)](https://www.npmjs.com/package/pr-checkmate)
+[![Downloads](https://img.shields.io/npm/dm/pr-checkmate?color=blue)](https://www.npmjs.com/package/pr-checkmate)
 ![License](https://img.shields.io/badge/license-Proprietary-lightgrey)
 ![ESLint](https://img.shields.io/badge/ESLint-10-4B32C3?logo=eslint&logoColor=white)
 ![Prettier](https://img.shields.io/badge/Prettier-3-F7B93E?logo=prettier&logoColor=white)
@@ -9,7 +10,7 @@
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
 [![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
 
-> PR CheckMate is a universal PR quality checker: one `npm install`, 49 checks across
+> PR CheckMate is a universal PR quality checker: one `npm install`, 51 checks across
 > 11 languages, running in CI on every pull request. The bundled languages need no
 > per-language toolchain setup.
 
@@ -72,6 +73,31 @@ Run all checks:
 npx pr-checkmate all
 ```
 
+### Running in CI without installing
+
+Plenty of repos never add pr-checkmate to `package.json` and call it on the fly in CI
+instead (`npx pr-checkmate`). That works, but there is no `node_modules` to generate a
+config from, so the run silently falls back to the defaults with no file to tune.
+`npx pr-checkmate init` is no help either, since the package is not kept around.
+
+Pull the published template instead:
+
+```bash
+curl -fsSL -O https://raw.githubusercontent.com/Mybono/pr_checkmate_public/main/pr-checkmate.json
+```
+
+Commit the file to the repository root and edit it there. Every check appears in it with
+its real default value and a short comment, so switching a check on or off, or changing
+one of its thresholds, is a one-line edit. The JSON schema is published alongside it for
+editor autocompletion, and the template already references it:
+
+```text
+https://raw.githubusercontent.com/Mybono/pr_checkmate_public/main/pr-checkmate.schema.json
+```
+
+Both files are refreshed on every release, so the template never drifts from the
+installed version.
+
 ## GitHub Actions
 
 Every workflow follows the same shape: checkout, set up Node, install, run. The
@@ -108,20 +134,24 @@ skipped, not failed.
 
 ## Checks
 
-49 checks, grouped by category and run in parallel within each phase:
+51 checks, grouped by category and run in parallel within each phase:
 
 - Universal git-diff (18) — language-agnostic and bundled: merge-conflict markers,
-  secret scan, diff security (JS/TS/Python/Go/Kotlin), GitHub Actions and Dockerfile
-  security, case-collision, custom rules, banned imports, license headers, leftover
-  debug lines, lockfile drift, large/binary files, TODO/FIXME, missing tests, coverage
-  presence, DB migration safety, and sensitive-file guard.
+  secret scan, diff security (JS/TS/Python/Go/Kotlin), diff smells, GitHub Actions and
+  Dockerfile security, case-collision, custom rules, banned imports, license headers,
+  leftover debug lines, lockfile drift, large/binary files, TODO/FIXME, missing tests,
+  coverage presence, DB migration safety, and sensitive-file guard.
 - Dependencies (7) — unused/missing, circular, outdated, license compliance, npm audit,
   a cross-language vuln scan (osv-scanner, opt-in), and a direct-dependency vuln scan
   (grype, on by default).
-- Quality (4) — duplicate code, dead code, multi-language spellcheck, markdown lint.
+- Quality (6) — duplicate code, dead code, multi-language spellcheck, markdown lint, YAML lint, config validation.
 - PR hygiene (4) — size, title, body, and commit-message convention.
 - Per-language (16) — lint, format, and type-check for the languages listed above.
 
+Each check has its own page in the
+[per-check reference](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/checks/INDEX.md),
+covering when it runs, the config keys it reads, and how to turn it off.
+
 ## Configuration
 
 Everything lives in `pr-checkmate.json`. Run `npx pr-checkmate init` to scaffold the
@@ -155,6 +185,9 @@ full file for your detected languages.
 }
 ```
 
+For the complete list of keys each check reads, along with their defaults, see the
+[per-check reference](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/checks/INDEX.md).
+
 ## PR Summary Comment
 
 After `npx pr-checkmate all`, a summary table is posted to the PR and updated in place

package/cspell.json

@@ -15,6 +15,7 @@
     "Accona",
     "acepto",
     "Acepto",
+    "acmecorp",
     "ACMR",
     "ACMRD",
     "acodec",
@@ -39,6 +40,7 @@
     "allclose",
     "Amuta",
     "análisis",
+    "analysers",
     "Anchore",
     "androidpublisher",
     "androidx",
@@ -340,6 +342,7 @@
     "endoftext",
     "endtable",
     "engineio",
+    "ENOENT",
     "eoilist",
     "Escaneá",
     "Escaneás",
@@ -684,6 +687,7 @@
     "mybono",
     "mydir",
     "myimage",
+    "myinternalservice",
     "mylib",
     "myorg",
     "myprefix",
@@ -812,6 +816,7 @@
     "preconcurrency",
     "pretrained",
     "prettier",
+    "println",
     "Privacidad",
     "processlist",
     "progressbar",
@@ -1076,6 +1081,7 @@
     "unsharp",
     "upbit",
     "updateemail",
+    "uppercased",
     "upsell",
     "usecase",
     "usefixtures",

package/dist/cli.js

@@ -19,6 +19,7 @@ const COMMAND_TO_CHECK = {
     'pr-title': 'PR Title',
     outdated: 'Outdated Deps',
     markdown: 'Markdown',
+    'yaml-lint': 'YAML Lint',
     typecheck: 'TypeScript',
     'diff-smell': 'Diff Smells',
     'diff-security': 'Diff Security',

package/dist/config/constants.js

@@ -240,6 +240,7 @@ exports.KNOWN_CONFIG_KEYS = new Set([
     'spellcheck',
     'cspell',
     'markdownlint',
+    'yamlLint',
     'typecheck',
     // security
     'security',

package/dist/core/checks/quality/yaml-lint.d.ts

@@ -0,0 +1,13 @@
+import { Check } from '../../types';
+/**
+ * Bundled YAML linter (the `yaml` package — no runner dependency, always
+ * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
+ * and reports the parser's own errors and warnings: syntax errors, duplicate map
+ * keys, tabs used as indentation, and other structural problems. Multi-document
+ * files (`---`-separated) are each parsed. ON by default — runs unless
+ * `yamlLint.enabled` is explicitly `false`. Findings are a hard error by default
+ * (a YAML problem fails the run); downgrade to advisory with
+ * `yamlLint.severity: "warn"`. Clients can exclude paths with `yamlLint.ignore`
+ * (glob patterns) in pr-checkmate.json.
+ */
+export declare const yamlLintCheck: Check;

package/dist/core/checks/quality/yaml-lint.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.yamlLintCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const yaml_1 = require("yaml");
+const utils_1 = require("../../../utils");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/** First line of a `yaml` error/warning message, stripped of its source excerpt. */
+function shortMessage(message) {
+    return message.split('\n')[0].trim();
+}
+/**
+ * Bundled YAML linter (the `yaml` package — no runner dependency, always
+ * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
+ * and reports the parser's own errors and warnings: syntax errors, duplicate map
+ * keys, tabs used as indentation, and other structural problems. Multi-document
+ * files (`---`-separated) are each parsed. ON by default — runs unless
+ * `yamlLint.enabled` is explicitly `false`. Findings are a hard error by default
+ * (a YAML problem fails the run); downgrade to advisory with
+ * `yamlLint.severity: "warn"`. Clients can exclude paths with `yamlLint.ignore`
+ * (glob patterns) in pr-checkmate.json.
+ */
+exports.yamlLintCheck = {
+    name: 'YAML Lint',
+    phase: 'blocking',
+    applies(ctx) {
+        return ctx.config.yamlLint?.enabled !== false;
+    },
+    async run(ctx) {
+        // Keep the CI/workflow dirs that are globally ignored: they hold the very
+        // YAML (GitHub Actions, GitLab CI, CircleCI) a YAML linter most needs to see.
+        const allTargets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml'], {
+            keepDirs: ['.github', '.gitlab', '.circleci'],
+        });
+        if (allTargets === null)
+            return (0, types_1.skip)('git unavailable');
+        if (allTargets.length === 0)
+            return (0, types_1.skip)('no YAML files');
+        const ignore = ctx.config.yamlLint?.ignore ?? [];
+        const targets = ignore.length > 0 ? allTargets.filter(f => !(0, utils_1.matchesAnyGlob)(f, ignore)) : allTargets;
+        if (targets.length === 0)
+            return (0, types_1.skip)('all YAML files ignored');
+        const issues = [];
+        for (const file of targets) {
+            let source;
+            try {
+                source = node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, file), 'utf-8');
+            }
+            catch (err) {
+                utils_1.logger.warn(`[YAML Lint]: ⚠️ Could not read ${file}: ${err}`);
+                continue;
+            }
+            // parseAllDocuments never throws — it collects problems on each document,
+            // so a single malformed file cannot abort the whole check.
+            const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true });
+            for (const doc of docs) {
+                for (const problem of [...doc.errors, ...doc.warnings]) {
+                    const pos = problem.linePos?.[0];
+                    issues.push({
+                        file,
+                        line: pos?.line,
+                        col: pos?.col,
+                        message: shortMessage(problem.message),
+                    });
+                }
+            }
+        }
+        if (issues.length === 0)
+            return (0, types_1.pass)();
+        // YAML problems are a hard error by default; a repo may downgrade to `warn`
+        // via `yamlLint.severity`.
+        const sev = (0, findings_1.severityEmitter)(ctx.config.yamlLint?.severity, 'error');
+        issues.slice(0, 10).forEach(i => {
+            const where = i.line ? `:${i.line}${i.col ? `:${i.col}` : ''}` : '';
+            sev.log(`[YAML Lint]: ${sev.icon} ${i.file}${where} — ${i.message}`);
+        });
+        if (issues.length > 10)
+            sev.log(`[YAML Lint]:   ... and ${issues.length - 10} more`);
+        return sev.emit(`${issues.length} YAML issue(s) found`);
+    },
+};

package/dist/core/registry.js

@@ -45,6 +45,7 @@ const duplicate_check_1 = require("./checks/quality/duplicate-check");
 const license_header_1 = require("./checks/quality/license-header");
 const markdown_lint_1 = require("./checks/quality/markdown-lint");
 const spellcheck_1 = require("./checks/quality/spellcheck");
+const yaml_lint_1 = require("./checks/quality/yaml-lint");
 const diff_security_1 = require("./checks/security/diff-security");
 const dockerfile_security_1 = require("./checks/security/dockerfile-security");
 const migration_safety_1 = require("./checks/security/migration-safety");
@@ -93,6 +94,7 @@ exports.REGISTRY = [
     outdated_deps_1.outdatedDepsCheck,
     markdown_lint_1.markdownLintCheck,
     spellcheck_1.spellcheckCheck,
+    yaml_lint_1.yamlLintCheck,
     python_lint_1.pythonLintCheck,
     python_typecheck_1.pythonTypecheckCheck,
     dead_code_1.deadCodeCheck,

package/dist/core/targets.d.ts

@@ -11,7 +11,9 @@ import type { CheckContext } from './types';
  * longer exists) can never hand a missing path to a downstream tool like ESLint
  * or Prettier, which crash hard on a non-existent pattern.
  */
-export declare function resolveTargetFiles(ctx: CheckContext, globs: string[]): Promise<string[] | null>;
+export declare function resolveTargetFiles(ctx: CheckContext, globs: string[], opts?: {
+    keepDirs?: string[];
+}): Promise<string[] | null>;
 /**
  * Like {@link resolveTargetFiles} but restricts results to the configured
  * `sourcePath`(s). Preserves the semantics of the old `sourcePath` full-scan

package/dist/core/targets.js

@@ -16,9 +16,15 @@ const execa_1 = require("../utils/execa");
  * curated default), matched on any path segment so nesting depth doesn't matter.
  * Applied to every check's file list so build/tooling/report dirs are never
  * scanned, even when committed.
+ *
+ * `keepDirs` un-ignores specific segments for a single check — e.g. YAML lint
+ * keeps the CI dirs (`.github`, `.gitlab`, `.circleci`), which are ignored
+ * globally but hold the workflow files a YAML linter most needs to see.
  */
-function excludeIgnoredDirs(files) {
+function excludeIgnoredDirs(files, keepDirs = []) {
     const ignored = new Set((0, config_1.getIgnoredDirs)());
+    for (const dir of keepDirs)
+        ignored.delete(dir);
     if (ignored.size === 0)
         return files;
     return files.filter(f => !f.split('/').some(segment => ignored.has(segment)));
@@ -35,7 +41,7 @@ function excludeIgnoredDirs(files) {
  * longer exists) can never hand a missing path to a downstream tool like ESLint
  * or Prettier, which crash hard on a non-existent pattern.
  */
-async function resolveTargetFiles(ctx, globs) {
+async function resolveTargetFiles(ctx, globs, opts = {}) {
     try {
         const args = ctx.baseSha
             ? [
@@ -57,7 +63,7 @@ async function resolveTargetFiles(ctx, globs) {
         const files = excludeIgnoredDirs(stdout
             .split('\n')
             .map(f => f.trim())
-            .filter(Boolean)).filter(f => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, f)));
+            .filter(Boolean), opts.keepDirs).filter(f => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, f)));
         utils_1.logger.info(`[targets]: ${ctx.baseSha ? '📂 Delta' : 'Full scan'}: ${files.length} file(s) for ${globs.join(', ')}`);
         return files;
     }

package/dist/init.js

@@ -68,6 +68,14 @@ const DEFAULT_CONFIG = {
         rules: {},
         ignores: [],
     },
+    // YAML lint (bundled `yaml` parser). Reports syntax errors, duplicate keys,
+    // and tab/indentation problems in .yml/.yaml files. Blocking by default
+    // (severity "error"); set severity "warn" to make it advisory, or enabled
+    // false to disable. `ignore` takes glob patterns to skip (e.g. "charts/**").
+    yamlLint: {
+        enabled: true,
+        ignore: [],
+    },
     // TypeScript type check
     typecheck: {
         enabled: true,

package/dist/interfaces/index.d.ts

@@ -197,6 +197,11 @@ export interface PRCheckMateConfig {
     configValidation?: {
         enabled?: boolean;
     };
+    yamlLint?: {
+        enabled?: boolean;
+        severity?: 'error' | 'warn';
+        ignore?: string[];
+    };
     vulnScan?: {
         enabled?: boolean;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.5",
+    "version": "1.23.7",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -61,14 +61,14 @@
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/Mybono/pr_checkmate.git"
+        "url": "git+https://github.com/Mybono/pr_checkmate_public.git"
     },
     "bugs": {
-        "url": "https://github.com/Mybono/pr_checkmate/issues"
+        "url": "https://github.com/Mybono/pr_checkmate_public/issues"
     },
     "homepage": "https://dev.to/deftoexplore/pr-checkmate-stop-debating-style-and-start-coding-ij",
     "author": "Artur Polishchuk",
-    "license": "LicenseRef-Proprietary",
+    "license": "UNLICENSED",
     "dependencies": {
         "@astral-sh/ruff-wasm-nodejs": "^0.15.20",
         "@commitlint/cli": "^21.2.0",
@@ -99,10 +99,19 @@
         "prettier": ">=3.0.0",
         "ts-node": "^10.9.1",
         "ts-unused-exports": "^11.0.1",
-        "typescript": "^6.0.3"
+        "typescript": "^6.0.3",
+        "yaml": "^2.9.0"
     },
     "devDependencies": {
         "standard-version": "^9.5.0",
         "typedoc": "^0.28.20"
+    },
+    "overrides": {
+        "markdownlint-cli2": {
+            "js-yaml": "5.2.2"
+        },
+        "cosmiconfig": {
+            "js-yaml": "4.3.0"
+        }
     }
 }

package/pr-checkmate.schema.json

@@ -148,6 +148,14 @@
     "caseCollision": { "$ref": "#/$defs/toggle" },
     "sensitiveFileGuard": { "$ref": "#/$defs/toggle" },
     "configValidation": { "$ref": "#/$defs/toggle" },
+    "yamlLint": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    },
     "typecheck": { "$ref": "#/$defs/toggle" },
     "prBody": {
       "type": "object",

package/src/config/cspell.json

@@ -15,6 +15,7 @@
     "Accona",
     "acepto",
     "Acepto",
+    "acmecorp",
     "ACMR",
     "ACMRD",
     "acodec",
@@ -39,6 +40,7 @@
     "allclose",
     "Amuta",
     "análisis",
+    "analysers",
     "Anchore",
     "androidpublisher",
     "androidx",
@@ -340,6 +342,7 @@
     "endoftext",
     "endtable",
     "engineio",
+    "ENOENT",
     "eoilist",
     "Escaneá",
     "Escaneás",
@@ -684,6 +687,7 @@
     "mybono",
     "mydir",
     "myimage",
+    "myinternalservice",
     "mylib",
     "myorg",
     "myprefix",
@@ -812,6 +816,7 @@
     "preconcurrency",
     "pretrained",
     "prettier",
+    "println",
     "Privacidad",
     "processlist",
     "progressbar",
@@ -1076,6 +1081,7 @@
     "unsharp",
     "upbit",
     "updateemail",
+    "uppercased",
     "upsell",
     "usecase",
     "usefixtures",

package/src/config/pr-checkmate.schema.json

@@ -148,6 +148,14 @@
     "caseCollision": { "$ref": "#/$defs/toggle" },
     "sensitiveFileGuard": { "$ref": "#/$defs/toggle" },
     "configValidation": { "$ref": "#/$defs/toggle" },
+    "yamlLint": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "severity": { "enum": ["error", "warn"] },
+        "ignore": { "type": "array", "items": { "type": "string" } }
+      }
+    },
     "typecheck": { "$ref": "#/$defs/toggle" },
     "prBody": {
       "type": "object",