pr-checkmate 1.23.6 → 1.23.8

package/LICENSE

@@ -11,16 +11,21 @@ This software and its source code, documentation, data, models, and all
 associated materials (collectively, the "Software") are the confidential and
 proprietary property of Mybono (the "Owner").
 
-NO LICENSE IS GRANTED. This is NOT open-source software. The Software is
-made available for viewing solely to persons explicitly and individually
-authorized in writing by the Owner. The mere presence of this source code in
-any repository, archive, or medium does NOT constitute permission to use it.
+NO LICENSE TO THE SOURCE CODE IS GRANTED. This is NOT open-source software.
+The source code is made available for viewing solely to persons explicitly
+and individually authorized in writing by the Owner. The mere presence of
+this source code in any repository, archive, or medium does NOT constitute
+permission to use it. A limited license to install and execute the compiled
+package published to the npm registry is granted separately below under
+"EXECUTION LICENSE FOR THE PUBLISHED NPM PACKAGE".
 
 ================================================================================
 RESTRICTIONS
 ================================================================================
 
-Without the prior express written permission of the Owner, you MAY NOT:
+Except as expressly granted below under "EXECUTION LICENSE FOR THE PUBLISHED
+NPM PACKAGE", and without the prior express written permission of the Owner,
+you MAY NOT:
 
   1. Copy, reproduce, or duplicate the Software, in whole or in part.
   2. Use or execute the Software for any purpose, commercial or otherwise.
@@ -32,9 +37,48 @@ Without the prior express written permission of the Owner, you MAY NOT:
   7. Remove, obscure, or alter this notice or any copyright, trademark, or
      other proprietary notices contained in the Software.
 
-Any use not expressly permitted in writing by the Owner is strictly
-prohibited and constitutes a violation of applicable copyright and
-intellectual property laws.
+Any use not expressly permitted in writing by the Owner or under the
+execution license below is strictly prohibited and constitutes a violation
+of applicable copyright and intellectual property laws.
+
+================================================================================
+EXECUTION LICENSE FOR THE PUBLISHED NPM PACKAGE
+================================================================================
+
+The Owner distributes a compiled build of the Software to the public npm
+registry under the package name "pr-checkmate" (the "Distributed Package")
+for the purpose of being installed and run by third parties. Solely with
+respect to the Distributed Package as published, the Owner grants any person
+who obtains it through the npm registry a worldwide, royalty-free,
+non-exclusive, non-transferable license to:
+
+  1. Install the Distributed Package via a package manager (e.g. `npm`,
+     `npx`) or use it as a GitHub Actions step.
+  2. Execute the Distributed Package's documented CLI and GitHub Actions
+     interfaces, including in automated CI/CD pipelines, against the
+     licensee's own code, for the purpose of running its automated checks.
+
+This grant does not include, and RESTRICTIONS 1 and 3 through 7 above
+continue to apply in full to, any right to: copy or redistribute the
+Distributed Package outside of standard package-manager installation; modify,
+decompile, or reverse engineer it; or access, copy, or create derivative
+works from any source code not included in the published npm tarball. This
+grant may be revoked by the Owner for future versions at any time; it does
+not affect versions already installed.
+
+================================================================================
+PUBLIC MIRROR EXCEPTION
+================================================================================
+
+The restrictions above do not prevent the Owner itself from publishing
+selected non-source materials — this LICENSE, the README, the CONTRIBUTING
+and CODE_OF_CONDUCT files, the documentation/ tree, and the configuration
+template and its JSON schema — to a public repository the Owner controls, for
+the sole purpose of giving consumers of the published npm package a reachable
+repository URL and readable documentation. This exception applies only to
+publication carried out by or on behalf of the Owner; it grants no rights to
+any other party to fork, mirror, re-host, or redistribute the Software, and it
+does not extend to the source code itself.
 
 ================================================================================
 NO WARRANTY

package/README.md

@@ -1,6 +1,7 @@
 # ♟️ PR CheckMate
 
-![Build](https://img.shields.io/github/actions/workflow/status/Mybono/sdk_automation/publish.yml?branch=main&label=CI&color=blue)
+[![npm](https://img.shields.io/npm/v/pr-checkmate?label=npm&color=CB3837&logo=npm&logoColor=white)](https://www.npmjs.com/package/pr-checkmate)
+[![Downloads](https://img.shields.io/npm/dm/pr-checkmate?color=blue)](https://www.npmjs.com/package/pr-checkmate)
 ![License](https://img.shields.io/badge/license-Proprietary-lightgrey)
 ![ESLint](https://img.shields.io/badge/ESLint-10-4B32C3?logo=eslint&logoColor=white)
 ![Prettier](https://img.shields.io/badge/Prettier-3-F7B93E?logo=prettier&logoColor=white)
@@ -9,7 +10,7 @@
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
 [![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
 
-> PR CheckMate is a universal PR quality checker: one `npm install`, 50 checks across
+> PR CheckMate is a universal PR quality checker: one `npm install`, 51 checks across
 > 11 languages, running in CI on every pull request. The bundled languages need no
 > per-language toolchain setup.
 
@@ -72,6 +73,31 @@ Run all checks:
 npx pr-checkmate all
 ```
 
+### Running in CI without installing
+
+Plenty of repos never add pr-checkmate to `package.json` and call it on the fly in CI
+instead (`npx pr-checkmate`). That works, but there is no `node_modules` to generate a
+config from, so the run silently falls back to the defaults with no file to tune.
+`npx pr-checkmate init` is no help either, since the package is not kept around.
+
+Pull the published template instead:
+
+```bash
+curl -fsSL -O https://raw.githubusercontent.com/Mybono/pr_checkmate_public/main/pr-checkmate.json
+```
+
+Commit the file to the repository root and edit it there. Every check appears in it with
+its real default value and a short comment, so switching a check on or off, or changing
+one of its thresholds, is a one-line edit. The JSON schema is published alongside it for
+editor autocompletion, and the template already references it:
+
+```text
+https://raw.githubusercontent.com/Mybono/pr_checkmate_public/main/pr-checkmate.schema.json
+```
+
+Both files are refreshed on every release, so the template never drifts from the
+installed version.
+
 ## GitHub Actions
 
 Every workflow follows the same shape: checkout, set up Node, install, run. The
@@ -108,20 +134,24 @@ skipped, not failed.
 
 ## Checks
 
-50 checks, grouped by category and run in parallel within each phase:
+51 checks, grouped by category and run in parallel within each phase:
 
 - Universal git-diff (18) — language-agnostic and bundled: merge-conflict markers,
-  secret scan, diff security (JS/TS/Python/Go/Kotlin), GitHub Actions and Dockerfile
-  security, case-collision, custom rules, banned imports, license headers, leftover
-  debug lines, lockfile drift, large/binary files, TODO/FIXME, missing tests, coverage
-  presence, DB migration safety, and sensitive-file guard.
+  secret scan, diff security (JS/TS/Python/Go/Kotlin), diff smells, GitHub Actions and
+  Dockerfile security, case-collision, custom rules, banned imports, license headers,
+  leftover debug lines, lockfile drift, large/binary files, TODO/FIXME, missing tests,
+  coverage presence, DB migration safety, and sensitive-file guard.
 - Dependencies (7) — unused/missing, circular, outdated, license compliance, npm audit,
   a cross-language vuln scan (osv-scanner, opt-in), and a direct-dependency vuln scan
   (grype, on by default).
-- Quality (5) — duplicate code, dead code, multi-language spellcheck, markdown lint, YAML lint.
+- Quality (6) — duplicate code, dead code, multi-language spellcheck, markdown lint, YAML lint, config validation.
 - PR hygiene (4) — size, title, body, and commit-message convention.
 - Per-language (16) — lint, format, and type-check for the languages listed above.
 
+Each check has its own page in the
+[per-check reference](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/checks/INDEX.md),
+covering when it runs, the config keys it reads, and how to turn it off.
+
 ## Configuration
 
 Everything lives in `pr-checkmate.json`. Run `npx pr-checkmate init` to scaffold the
@@ -155,6 +185,9 @@ full file for your detected languages.
 }
 ```
 
+For the complete list of keys each check reads, along with their defaults, see the
+[per-check reference](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/checks/INDEX.md).
+
 ## PR Summary Comment
 
 After `npx pr-checkmate all`, a summary table is posted to the PR and updated in place

package/cspell.json

@@ -15,6 +15,7 @@
     "Accona",
     "acepto",
     "Acepto",
+    "acmecorp",
     "ACMR",
     "ACMRD",
     "acodec",
@@ -39,6 +40,7 @@
     "allclose",
     "Amuta",
     "análisis",
+    "analysers",
     "Anchore",
     "androidpublisher",
     "androidx",
@@ -340,6 +342,7 @@
     "endoftext",
     "endtable",
     "engineio",
+    "ENOENT",
     "eoilist",
     "Escaneá",
     "Escaneás",
@@ -684,6 +687,7 @@
     "mybono",
     "mydir",
     "myimage",
+    "myinternalservice",
     "mylib",
     "myorg",
     "myprefix",
@@ -812,6 +816,7 @@
     "preconcurrency",
     "pretrained",
     "prettier",
+    "println",
     "Privacidad",
     "processlist",
     "progressbar",
@@ -1076,6 +1081,7 @@
     "unsharp",
     "upbit",
     "updateemail",
+    "uppercased",
     "upsell",
     "usecase",
     "usefixtures",

package/dist/core/checks/quality/yaml-lint.js

@@ -33,7 +33,11 @@ exports.yamlLintCheck = {
         return ctx.config.yamlLint?.enabled !== false;
     },
     async run(ctx) {
-        const allTargets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml']);
+        // Keep the CI/workflow dirs that are globally ignored: they hold the very
+        // YAML (GitHub Actions, GitLab CI, CircleCI) a YAML linter most needs to see.
+        const allTargets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml'], {
+            keepDirs: ['.github', '.gitlab', '.circleci'],
+        });
         if (allTargets === null)
             return (0, types_1.skip)('git unavailable');
         if (allTargets.length === 0)

package/dist/core/targets.d.ts

@@ -11,7 +11,9 @@ import type { CheckContext } from './types';
  * longer exists) can never hand a missing path to a downstream tool like ESLint
  * or Prettier, which crash hard on a non-existent pattern.
  */
-export declare function resolveTargetFiles(ctx: CheckContext, globs: string[]): Promise<string[] | null>;
+export declare function resolveTargetFiles(ctx: CheckContext, globs: string[], opts?: {
+    keepDirs?: string[];
+}): Promise<string[] | null>;
 /**
  * Like {@link resolveTargetFiles} but restricts results to the configured
  * `sourcePath`(s). Preserves the semantics of the old `sourcePath` full-scan

package/dist/core/targets.js

@@ -16,9 +16,15 @@ const execa_1 = require("../utils/execa");
  * curated default), matched on any path segment so nesting depth doesn't matter.
  * Applied to every check's file list so build/tooling/report dirs are never
  * scanned, even when committed.
+ *
+ * `keepDirs` un-ignores specific segments for a single check — e.g. YAML lint
+ * keeps the CI dirs (`.github`, `.gitlab`, `.circleci`), which are ignored
+ * globally but hold the workflow files a YAML linter most needs to see.
  */
-function excludeIgnoredDirs(files) {
+function excludeIgnoredDirs(files, keepDirs = []) {
     const ignored = new Set((0, config_1.getIgnoredDirs)());
+    for (const dir of keepDirs)
+        ignored.delete(dir);
     if (ignored.size === 0)
         return files;
     return files.filter(f => !f.split('/').some(segment => ignored.has(segment)));
@@ -35,7 +41,7 @@ function excludeIgnoredDirs(files) {
  * longer exists) can never hand a missing path to a downstream tool like ESLint
  * or Prettier, which crash hard on a non-existent pattern.
  */
-async function resolveTargetFiles(ctx, globs) {
+async function resolveTargetFiles(ctx, globs, opts = {}) {
     try {
         const args = ctx.baseSha
             ? [
@@ -57,7 +63,7 @@ async function resolveTargetFiles(ctx, globs) {
         const files = excludeIgnoredDirs(stdout
             .split('\n')
             .map(f => f.trim())
-            .filter(Boolean)).filter(f => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, f)));
+            .filter(Boolean), opts.keepDirs).filter(f => node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, f)));
         utils_1.logger.info(`[targets]: ${ctx.baseSha ? '📂 Delta' : 'Full scan'}: ${files.length} file(s) for ${globs.join(', ')}`);
         return files;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.23.6",
+    "version": "1.23.8",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -61,14 +61,14 @@
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/Mybono/pr_checkmate.git"
+        "url": "git+https://github.com/Mybono/pr_checkmate_public.git"
     },
     "bugs": {
-        "url": "https://github.com/Mybono/pr_checkmate/issues"
+        "url": "https://github.com/Mybono/pr_checkmate_public/issues"
     },
     "homepage": "https://dev.to/deftoexplore/pr-checkmate-stop-debating-style-and-start-coding-ij",
     "author": "Artur Polishchuk",
-    "license": "LicenseRef-Proprietary",
+    "license": "UNLICENSED",
     "dependencies": {
         "@astral-sh/ruff-wasm-nodejs": "^0.15.20",
         "@commitlint/cli": "^21.2.0",
@@ -105,5 +105,13 @@
     "devDependencies": {
         "standard-version": "^9.5.0",
         "typedoc": "^0.28.20"
+    },
+    "overrides": {
+        "markdownlint-cli2": {
+            "js-yaml": "5.2.2"
+        },
+        "cosmiconfig": {
+            "js-yaml": "4.3.0"
+        }
     }
 }

package/src/config/cspell.json

@@ -15,6 +15,7 @@
     "Accona",
     "acepto",
     "Acepto",
+    "acmecorp",
     "ACMR",
     "ACMRD",
     "acodec",
@@ -39,6 +40,7 @@
     "allclose",
     "Amuta",
     "análisis",
+    "analysers",
     "Anchore",
     "androidpublisher",
     "androidx",
@@ -340,6 +342,7 @@
     "endoftext",
     "endtable",
     "engineio",
+    "ENOENT",
     "eoilist",
     "Escaneá",
     "Escaneás",
@@ -684,6 +687,7 @@
     "mybono",
     "mydir",
     "myimage",
+    "myinternalservice",
     "mylib",
     "myorg",
     "myprefix",
@@ -812,6 +816,7 @@
     "preconcurrency",
     "pretrained",
     "prettier",
+    "println",
     "Privacidad",
     "processlist",
     "progressbar",
@@ -1076,6 +1081,7 @@
     "unsharp",
     "upbit",
     "updateemail",
+    "uppercased",
     "upsell",
     "usecase",
     "usefixtures",