pr-checkmate 2.0.0 → 2.1.2

package/README.md

@@ -10,6 +10,7 @@
 ![cspell](https://img.shields.io/badge/cspell-10-4285F4)
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
 [![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
+[![Container](https://img.shields.io/badge/ghcr.io-pr--checkmate-2496ED?logo=docker&logoColor=white)](https://github.com/users/Mybono/packages/container/package/pr-checkmate)
 
 > PR CheckMate is a security-first PR gate: secret scanning, dependency
 > vulnerability checks, and a signed SBOM + independent VirusTotal scan on
@@ -121,13 +122,39 @@ npx pr-checkmate all --full
 npx pr-checkmate lint --full
 ```
 
-The 16 checks that only make sense on a diff (PR Size, Diff Security, Merge Conflict, Custom
-Rules, Banned Imports, the git-diff family) drop out of the report on a full scan. The
+Only three checks genuinely need a diff and drop out of a full scan — PR Size, Missing
+Tests and Lockfile Drift. Everything else, the whole security family included, scans the
+working tree when there is no diff to read. The
 [per-check reference](https://github.com/Mybono/pr_checkmate_public/blob/main/documentation/checks/INDEX.md)
 spells out the rules under "Review scope".
 
 ### Running in CI without installing
 
+**Use the container.** With no `node_modules` to reuse, a cold `npx` downloads 547 MB and
+takes about five minutes — on every job. The image carries the whole toolchain already:
+
+```bash
+docker run --rm -v "$PWD:/repo" --user "$(id -u):$(id -g)" \
+  ghcr.io/mybono/pr-checkmate:latest all
+```
+
+161 MB pulled once and cached by the runner, and the checks that need a binary on the
+machine — ShellCheck among them — are inside, so they stop silently skipping. Pin the
+version tag (`:2.0.0`) for a reproducible pipeline; `--user` keeps files that formatters
+rewrite owned by you rather than by root.
+
+Verify what you pulled — the image carries SLSA provenance and an SBOM, attached to
+the image itself in the registry:
+
+```bash
+docker buildx imagetools inspect ghcr.io/mybono/pr-checkmate:2 \
+  --format '{{ json .Provenance }}'
+```
+
+[All tags →](https://github.com/users/Mybono/packages/container/package/pr-checkmate)
+
+The `npx` route still works, and the rest of this section is about making it comfortable.
+
 Plenty of repos never add pr-checkmate to `package.json` and call it on the fly in CI
 instead (`npx pr-checkmate`). That works, but there is no `node_modules` to generate a
 config from, so the run silently falls back to the defaults with no file to tune.

package/cspell.json

@@ -1752,7 +1752,14 @@
     "/**/yarn.lock",
     "/**/pnpm-lock.yaml",
     "/**/*.min.js",
-    "/**/*.min.css"
+    "/**/*.min.css",
+    "/CHANGELOG.md",
+    "/**/__tests__/**",
+    "/**/__mocks__/**",
+    "/**/*.test.*",
+    "/**/*.spec.*",
+    "/**/test/**",
+    "/**/tests/**"
   ],
   "enableFiletypes": ["typescript", "javascript", "markdown", "json"],
   "ignoreRegExpList": ["/https?:\\/\\/[^\\s]+/g", "/\\b[0-9a-f]{7,40}\\b/gi"]

package/dist/config/constants.d.ts

@@ -17,6 +17,18 @@ export declare const IGNORED_DIRS: string[];
  * nested report globs that are not plain directory names.
  */
 export declare const IGNORE_PATTERNS: string[];
+/**
+ * Where test code lives, as globs.
+ *
+ * Deliberately NOT part of {@link IGNORED_DIRS}: that list hides a directory from
+ * every check, and test code still wants linting, type-checking and formatting.
+ * What test code does not want is the handful of checks whose findings are noise
+ * on it — duplication (setup boilerplate repeats by design), unused exports (the
+ * runner consumes them), spelling (fixture identifiers) and the diff security
+ * scan (a test's whole job may be to call the dangerous thing). Each of those
+ * defaults to this list, and each lets a client replace it.
+ */
+export declare const TEST_PATH_GLOBS: string[];
 /**
  * Test files/folders excluded from duplicate-code detection by default.
  * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
@@ -24,6 +36,24 @@ export declare const IGNORE_PATTERNS: string[];
  * override this list via `duplicate.ignore` in pr-checkmate.json.
  */
 export declare const DUPLICATE_IGNORE_DEFAULTS: string[];
+/**
+ * Paths the diff security scan skips by default.
+ *
+ * A security test corpus is built out of the exact constructs the scan hunts for
+ * — `eval()`, `document.write()`, `__proto__` — so scanning it turns every added
+ * test case into a finding, and under `severity: error` into a blocked merge.
+ * Clients can override via `diffSecurity.ignorePaths` (which REPLACES this list).
+ */
+export declare const DIFF_SECURITY_IGNORE_DEFAULTS: string[];
+/**
+ * Files written by a release tool rather than by a person.
+ *
+ * `CHANGELOG.md` is assembled from commit subjects, so every typo anyone has ever
+ * committed reappears in it — 39 of 42 spellcheck findings in one real repository
+ * came from that one file, none of them actionable: the text cannot be corrected
+ * without rewriting git history, and the next release regenerates it anyway.
+ */
+export declare const GENERATED_DOC_FILES: string[];
 /**
  * Files excluded from the dead-code (unused-exports) report by default. These are
  * REGEX sources (matched against each reported file path), not globs — dead-code's
@@ -40,6 +70,13 @@ export declare const CONFIG_FILE_PATTERNS: string[];
  * config/CI YAML and JSON out of the report — they are data, not code, and their
  * repetition is not meaningful duplication. This mirrors the code-only file set the
  * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ *
+ * One entry per language pr-checkmate detects, all of them verified against the
+ * jscpd binary rather than assumed: the list used to stop at C++ while the check
+ * only ever handed jscpd `.ts`/`.js` files, so the Go, Rust, C#, Ruby and PHP
+ * halves were unreachable and the Python one was decoration. Copy-paste is a
+ * language-independent smell, and the tokenizer behind this check has always been
+ * able to see it — the file list was the only thing in the way.
  */
 export declare const DUPLICATE_CODE_FORMATS: string[];
 /**

package/dist/config/constants.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KNOWN_CONFIG_KEYS = exports.CONFIG_FILE = exports.documentation = exports.FULL_CONFIG_URL = exports.DOCS_URL = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
+exports.KNOWN_CONFIG_KEYS = exports.CONFIG_FILE = exports.documentation = exports.FULL_CONFIG_URL = exports.DOCS_URL = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.GENERATED_DOC_FILES = exports.DIFF_SECURITY_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.TEST_PATH_GLOBS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
 const node_path_1 = __importDefault(require("node:path"));
 /**
  * Build output, dependency, tooling, and report directories that are never
@@ -86,6 +86,11 @@ exports.IGNORED_DIRS = [
     'allure-results',
     'playwright-report',
     '.wdio',
+    // Generated knowledge-graph output. Committed by repos that keep the graph in
+    // version control, and machine-written from end to end: a multi-megabyte
+    // `graph.json` trips the large-file check, and `GRAPH_REPORT.md` carries every
+    // identifier in the codebase past the spellchecker. Neither is anyone's source.
+    'graphify-out',
 ];
 /**
  * Glob form of the ignore list, for tools that take glob ignores directly
@@ -110,12 +115,17 @@ exports.IGNORE_PATTERNS = [
     '**/audit-report/**',
 ];
 /**
- * Test files/folders excluded from duplicate-code detection by default.
- * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
- * them as clones is noise that drowns out real production duplication. Clients can
- * override this list via `duplicate.ignore` in pr-checkmate.json.
+ * Where test code lives, as globs.
+ *
+ * Deliberately NOT part of {@link IGNORED_DIRS}: that list hides a directory from
+ * every check, and test code still wants linting, type-checking and formatting.
+ * What test code does not want is the handful of checks whose findings are noise
+ * on it — duplication (setup boilerplate repeats by design), unused exports (the
+ * runner consumes them), spelling (fixture identifiers) and the diff security
+ * scan (a test's whole job may be to call the dangerous thing). Each of those
+ * defaults to this list, and each lets a client replace it.
  */
-exports.DUPLICATE_IGNORE_DEFAULTS = [
+exports.TEST_PATH_GLOBS = [
     '**/__tests__/**',
     '**/__mocks__/**',
     '**/*.test.*',
@@ -123,6 +133,31 @@ exports.DUPLICATE_IGNORE_DEFAULTS = [
     '**/test/**',
     '**/tests/**',
 ];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+exports.DUPLICATE_IGNORE_DEFAULTS = [...exports.TEST_PATH_GLOBS];
+/**
+ * Paths the diff security scan skips by default.
+ *
+ * A security test corpus is built out of the exact constructs the scan hunts for
+ * — `eval()`, `document.write()`, `__proto__` — so scanning it turns every added
+ * test case into a finding, and under `severity: error` into a blocked merge.
+ * Clients can override via `diffSecurity.ignorePaths` (which REPLACES this list).
+ */
+exports.DIFF_SECURITY_IGNORE_DEFAULTS = [...exports.TEST_PATH_GLOBS];
+/**
+ * Files written by a release tool rather than by a person.
+ *
+ * `CHANGELOG.md` is assembled from commit subjects, so every typo anyone has ever
+ * committed reappears in it — 39 of 42 spellcheck findings in one real repository
+ * came from that one file, none of them actionable: the text cannot be corrected
+ * without rewriting git history, and the next release regenerates it anyway.
+ */
+exports.GENERATED_DOC_FILES = ['CHANGELOG.md'];
 /**
  * Files excluded from the dead-code (unused-exports) report by default. These are
  * REGEX sources (matched against each reported file path), not globs — dead-code's
@@ -157,6 +192,13 @@ exports.CONFIG_FILE_PATTERNS = [
  * config/CI YAML and JSON out of the report — they are data, not code, and their
  * repetition is not meaningful duplication. This mirrors the code-only file set the
  * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ *
+ * One entry per language pr-checkmate detects, all of them verified against the
+ * jscpd binary rather than assumed: the list used to stop at C++ while the check
+ * only ever handed jscpd `.ts`/`.js` files, so the Go, Rust, C#, Ruby and PHP
+ * halves were unreachable and the Python one was decoration. Copy-paste is a
+ * language-independent smell, and the tokenizer behind this check has always been
+ * able to see it — the file list was the only thing in the way.
  */
 exports.DUPLICATE_CODE_FORMATS = [
     'javascript',
@@ -168,6 +210,11 @@ exports.DUPLICATE_CODE_FORMATS = [
     'swift',
     'c',
     'cpp',
+    'csharp',
+    'go',
+    'php',
+    'ruby',
+    'rust',
 ];
 /**
  * File extensions to check

package/dist/config/pr-checkmate-workflow-docker.yml

@@ -0,0 +1,79 @@
+name: PR CheckMate
+
+# The container variant, scaffolded because this repository does not carry
+# pr-checkmate as a dependency.
+#
+# The alternative would be `npx pr-checkmate`, and with no node_modules to reuse
+# that resolves to whatever is newest on the registry and downloads it again on
+# every job: 547 MB and about five minutes, measured. Worse, a major release
+# would land on you without a line changing here — and a major release of a gate
+# can start failing builds that passed yesterday.
+#
+# The image is pulled once and cached by the runner, and the tag below pins the
+# major so nothing moves under you.
+
+on:
+  pull_request:
+    branches: [main, master, develop]
+    types: [opened, synchronize, reopened]
+
+# Least privilege. `pull-requests: write` is what lets the run upsert its summary
+# comment on the PR; drop it and the checks still run, they just report to the log.
+permissions:
+  contents: read
+  pull-requests: write
+
+# Push three times in a minute and the first two runs become answers to questions
+# nobody is asking any more — they still hold a runner, and they still race to
+# upsert the summary comment, so a stale verdict can land on top of a fresh one.
+# Keyed per PR, so runs on different pull requests never cancel each other.
+concurrency:
+  group: pr-checkmate-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr-checkmate:
+    name: PR CheckMate
+    runs-on: ubuntu-latest
+    # A hung step otherwise runs to GitHub's six-hour default before anyone hears
+    # about it. Every check has its own internal timeout; this is the backstop.
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          # Required, not optional. Without the full history the PR base commit is
+          # not in the clone, no diff range can be built, and every diff-based
+          # check skips itself. The run then says `Scan Scope: … set
+          # fetch-depth: 0`, which is this line.
+          fetch-depth: 0
+
+      # One job runs the whole registry. Which checks run is decided in
+      # pr-checkmate.json (`severity`), not by splitting this into jobs.
+      #
+      # `--user` is not a detail: without it every file a formatter rewrites comes
+      # back owned by root, and the next step in your pipeline fails on
+      # permissions long after this one reported success.
+      #
+      # The environment variables are passed through by name rather than by value:
+      # the run reads them to find the PR, and interpolating them into the command
+      # line would put their contents into a shell.
+      - name: Run PR CheckMate
+        env:
+          # Not injected automatically: without this the run cannot authenticate,
+          # and the summary comment silently never reaches the PR.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          docker run --rm \
+            -v "$PWD:/repo" \
+            --user "$(id -u):$(id -g)" \
+            -e GITHUB_TOKEN \
+            -e GITHUB_REPOSITORY \
+            -e GITHUB_EVENT_NAME \
+            -e GITHUB_EVENT_PATH \
+            -e GITHUB_REF \
+            -e GITHUB_SHA \
+            -e CI \
+            -v "$GITHUB_EVENT_PATH:$GITHUB_EVENT_PATH:ro" \
+            ghcr.io/mybono/pr-checkmate:__IMAGE_TAG__ all

package/dist/config/pr-checkmate-workflow.yml

@@ -11,10 +11,23 @@ permissions:
   contents: read
   pull-requests: write
 
+# Push three times in a minute and the first two runs become answers to questions
+# nobody is asking any more — they still hold a runner, and they still race to
+# upsert the summary comment, so a stale verdict can land on top of a fresh one.
+# Keyed per PR, so runs on different pull requests never cancel each other.
+concurrency:
+  group: pr-checkmate-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pr-checkmate:
     name: PR CheckMate
     runs-on: ubuntu-latest
+    # A hung step otherwise runs to GitHub's six-hour default before anyone hears
+    # about it. Every check here has its own internal timeout; this is the backstop
+    # for the ones that cannot fail themselves — a wedged network fetch, a tool
+    # waiting on stdin. Raise it for a large monorepo.
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -48,9 +61,29 @@ jobs:
           restore-keys: |
             pr-checkmate-${{ runner.os }}-
 
+      # Grype keeps its own vulnerability database, and it is the single largest
+      # download in the whole run: 134 MB compressed, 1.9 GB unpacked, refreshed
+      # daily upstream. Without this step every job pays for it again. The key is
+      # dated rather than content-hashed, because the thing that changes is the
+      # upstream database, not anything in this repository — a stale entry is
+      # restored by the prefix and grype updates it in place.
+      - name: Cache Grype vulnerability database
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cache/grype
+          key: grype-db-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            grype-db-${{ runner.os }}-
+
       # One job runs the whole registry. Splitting it per check would repeat the
       # checkout and install for every one of them, and the selection of what runs
       # belongs in pr-checkmate.json (`severity`), not in copied YAML.
+      #
+      # This template is the one `init` scaffolds when pr-checkmate IS a
+      # dependency: `npm ci` above installs it, so npx runs that copy at the
+      # version your lockfile pins. A repository that does not install it gets
+      # the container variant instead, because bare `npx` would resolve to the
+      # newest release and download it on every job.
       - name: Run PR CheckMate
         env:
           # Not injected automatically: without this the run cannot authenticate,

package/dist/core/checks/dependencies/dependency-check.js

@@ -106,7 +106,7 @@ exports.dependencyCheck = {
     applies(ctx) {
         if (ctx.config.dependency?.enabled === false)
             return false;
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // Resolve the bundled knip binary and run it via the current node — never

package/dist/core/checks/dependencies/license-check.js

@@ -1,11 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseCheck = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
@@ -19,7 +14,7 @@ exports.licenseCheck = {
     name: 'License Check',
     phase: 'blocking',
     applies(ctx) {
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);

package/dist/core/checks/dependencies/npm-audit.js

@@ -34,7 +34,7 @@ exports.npmAuditCheck = {
     applies(ctx) {
         if (ctx.config.security?.['npm-audit']?.enabled === false)
             return false;
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // `high`, not `moderate`. A moderate CVE in a direct dependency often has no

package/dist/core/checks/dependencies/outdated-deps.js

@@ -1,11 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.outdatedDepsCheck = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
@@ -16,7 +11,7 @@ exports.outdatedDepsCheck = {
     applies(ctx) {
         if (ctx.config.outdatedDeps?.enabled === false)
             return false;
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // `npm outdated` queries the registry for every dependency and can take a

package/dist/core/checks/quality/duplicate-check.js

@@ -7,6 +7,37 @@ const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+/**
+ * The files to hand jscpd, per language.
+ *
+ * This map is why the check reads `ctx.languages` at all. It used to pass a fixed
+ * `*.ts,*.tsx,*.js,*.jsx` and gate itself on TypeScript/JavaScript, so a Python
+ * repository got `⏭️ Duplicate Code: no relevant files` — not because it had no
+ * duplication, but because nothing ever looked. The formats list in `constants.ts`
+ * named Python and C++ all along, which made the report's own claim untrue.
+ *
+ * Extensions mirror `detect-language.ts` so a language that decides the check runs
+ * is a language whose files it actually scans, with one deliberate addition: `.c`
+ * and `.h` under `cpp`, since a C project detects as `cpp` and the `c` format is
+ * one jscpd supports.
+ */
+const LANGUAGE_GLOBS = {
+    typescript: ['*.ts', '*.tsx'],
+    javascript: ['*.js', '*.jsx', '*.mjs', '*.cjs'],
+    python: ['*.py'],
+    cpp: ['*.cpp', '*.cc', '*.cxx', '*.c++', '*.hpp', '*.hh', '*.hxx', '*.c', '*.h'],
+    swift: ['*.swift'],
+    kotlin: ['*.kt', '*.kts', '*.java'],
+    go: ['*.go'],
+    rust: ['*.rs'],
+    csharp: ['*.cs'],
+    ruby: ['*.rb'],
+    php: ['*.php'],
+};
+/** The scan globs for one run: every detected language jscpd can tokenise. */
+function globsFor(languages) {
+    return [...new Set(languages.flatMap(lang => LANGUAGE_GLOBS[lang] ?? []))];
+}
 // Always excluded regardless of client config — scanning these never yields
 // meaningful production duplication. Config files (eslint/*.config.*) are data,
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
@@ -36,12 +67,12 @@ exports.duplicateCheck = {
     applies(ctx) {
         if (ctx.config.duplicate?.enabled === false)
             return false;
-        return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
+        return globsFor(ctx.languages).length > 0;
     },
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)());
         if (targetPaths === null)
             return (0, types_1.skip)('git unavailable');
         if (targetPaths.length === 0)

package/dist/core/checks/quality/markdown-lint.js

@@ -72,15 +72,20 @@ exports.markdownLintCheck = {
             'coverage/**',
             'graphify-out/**',
             '.claude/**',
+            // Release-tool output, not prose anyone edits — see GENERATED_DOC_FILES.
+            ...config_1.GENERATED_DOC_FILES,
             ...(userConfig.ignores ?? []),
         ];
         // markdownlint-cli2 has no --ignore-path flag; exclusions are expressed as
         // negated globs (`#pattern`). A bare directory name also needs `#name/**`
-        // to exclude its contents.
+        // to exclude its contents — but a filename does not, and `#CHANGELOG.md/**`
+        // is a glob that can never match. `path.extname` is what tells them apart,
+        // and it reads a leading dot as part of the name, so `.claude` is still
+        // treated as the directory it is.
         const ignoreGlobs = defaultIgnorePatterns.flatMap(pattern => {
             const clean = pattern.replace(/\/+$/, '');
             const globs = [`#${clean}`];
-            if (!clean.includes('*'))
+            if (!clean.includes('*') && !node_path_1.default.extname(clean))
                 globs.push(`#${clean}/**`);
             return globs;
         });

package/dist/core/checks/security/diff-security.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSecurityCheck = void 0;
+const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
@@ -293,7 +294,10 @@ exports.diffSecurityCheck = {
             const found = (0, findings_1.emptyBuckets)();
             const scanOpts = {
                 comments: cfg.commentHandling ?? 'language',
-                ignorePaths: cfg.ignorePaths,
+                // Setting `ignorePaths` REPLACES the test-path defaults rather than adding
+                // to them, matching `duplicate.ignore` and `deadCode.ignoreFiles`. A client
+                // who wants their tests scanned says so by listing something else here.
+                ignorePaths: cfg.ignorePaths ?? config_1.DIFF_SECURITY_IGNORE_DEFAULTS,
             };
             const extra = compileExtraPatterns(ctx);
             const disabled = cfg.disablePatterns ?? [];

package/dist/core/install/doctor.d.ts

@@ -1,8 +1,8 @@
 import { type LanguageUsage } from '../../utils/detect-language';
+import { packageVersion } from '../../utils/package-version';
 import { type EnsureResult } from './ensure';
 import { type ProfileDecision } from './profiles';
-/** Our own version, read from the package manifest that ships with us. */
-export declare function packageVersion(): string;
+export { packageVersion };
 /**
  * Everything the install layer knows about this repository, in one shot.
  *

package/dist/core/install/doctor.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.packageVersion = packageVersion;
+exports.packageVersion = void 0;
 exports.planInstall = planInstall;
 exports.installProfiles = installProfiles;
 exports.runDoctor = runDoctor;
@@ -13,19 +13,11 @@ const node_path_1 = __importDefault(require("node:path"));
 const loader_1 = require("../../config/loader");
 const detect_language_1 = require("../../utils/detect-language");
 const logger_1 = require("../../utils/logger");
+const package_version_1 = require("../../utils/package-version");
+Object.defineProperty(exports, "packageVersion", { enumerable: true, get: function () { return package_version_1.packageVersion; } });
 const cache_1 = require("./cache");
 const ensure_1 = require("./ensure");
 const profiles_1 = require("./profiles");
-/** Our own version, read from the package manifest that ships with us. */
-function packageVersion() {
-    try {
-        const manifest = node_path_1.default.resolve(__dirname, '../../..', 'package.json');
-        return JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8')).version ?? '0.0.0';
-    }
-    catch {
-        return '0.0.0';
-    }
-}
 /**
  * Everything the install layer knows about this repository, in one shot.
  *
@@ -36,7 +28,7 @@ function packageVersion() {
 async function planInstall(cwd = process.cwd(), usage) {
     const config = (0, loader_1.loadProjectConfig)();
     const detected = usage ?? (await (0, detect_language_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect));
-    const location = (0, cache_1.resolveCacheDir)(packageVersion(), config.install?.cacheDir);
+    const location = (0, cache_1.resolveCacheDir)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
     return { decisions: (0, profiles_1.planProfiles)(detected, config), cacheDir: location?.dir ?? null };
 }
 /** Whether a profile's tooling is present in the cache right now. */
@@ -71,7 +63,7 @@ async function installProfiles(cwd = process.cwd(), all = false) {
     // packages fight over npm's cache and gain nothing; the wall-clock cost lands
     // once, on a cold cache, and clarity of the log matters more there.
     for (const profile of wanted) {
-        results.push(await (0, ensure_1.ensureProfile)(profile, { cwd, version: packageVersion(), install }));
+        results.push(await (0, ensure_1.ensureProfile)(profile, { cwd, version: (0, package_version_1.packageVersion)(), install }));
     }
     return results;
 }
@@ -90,7 +82,7 @@ async function runDoctor(cwd = process.cwd()) {
     const lines = [];
     lines.push('PR CheckMate — install doctor');
     lines.push('');
-    lines.push(`  version    ${packageVersion()}`);
+    lines.push(`  version    ${(0, package_version_1.packageVersion)()}`);
     lines.push(`  repository ${cwd}`);
     lines.push(`  cache      ${cacheDir ?? 'unavailable (no writable directory)'}`);
     lines.push(`  strategy   ${config.install?.strategy ?? 'adaptive'}`);
@@ -116,7 +108,7 @@ async function runDoctor(cwd = process.cwd()) {
         lines.push(`  ${missing.length} profile(s) not installed yet. They are fetched on the next`);
         lines.push('  run, or now with: npx pr-checkmate install');
     }
-    const stale = (0, cache_1.stalePaths)(packageVersion(), config.install?.cacheDir);
+    const stale = (0, cache_1.stalePaths)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length > 0) {
         lines.push('');
         lines.push(`  ${stale.length} directory(ies) from other versions: npx pr-checkmate cache-prune`);
@@ -126,7 +118,7 @@ async function runDoctor(cwd = process.cwd()) {
 /** Remove cached tooling belonging to other versions of pr-checkmate. */
 function pruneCache() {
     const config = (0, loader_1.loadProjectConfig)();
-    const stale = (0, cache_1.stalePaths)(packageVersion(), config.install?.cacheDir);
+    const stale = (0, cache_1.stalePaths)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length === 0) {
         logger_1.logger.print('Nothing to prune — no tooling from other versions is cached.');
         return;

package/dist/core/reporters.js

@@ -8,6 +8,7 @@ exports.report = report;
 const node_fs_1 = __importDefault(require("node:fs"));
 const utils_1 = require("../utils");
 const http_1 = require("../utils/http");
+const package_version_1 = require("../utils/package-version");
 const STATUS_ICON = {
     pass: '✅',
     warn: '⚠️',
@@ -74,7 +75,7 @@ function buildMarkdownReport(report, cfg = {}) {
         // Say so rather than letting the table quietly disagree with the counts above.
         ...(hidden > 0 ? ['', `_${hidden} row(s) hidden by \`reporter.include\`._`] : []),
         '',
-        '_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate)_',
+        `_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate) v${(0, package_version_1.packageVersion)()}_`,
     ].join('\n');
 }
 /**
@@ -89,7 +90,12 @@ function printStdout(report, cfg) {
     const { passed, warned, failed, skipped } = report.summary;
     utils_1.logger.print('');
     utils_1.logger.print(SUMMARY_BORDER);
-    utils_1.logger.print('  PR CheckMate Summary');
+    // The version belongs in the headline, not in a footnote. Which copy of
+    // pr-checkmate produced a report is the first thing to establish when the
+    // report disagrees with what someone expects, and it is not otherwise
+    // recoverable from the log: a stale global install answers `pr-checkmate` on
+    // `PATH` ahead of the project's own, and reads the same config while doing it.
+    utils_1.logger.print(`  PR CheckMate Summary  ·  v${(0, package_version_1.packageVersion)()}`);
     utils_1.logger.print(SUMMARY_BORDER);
     for (const r of report.results) {
         const details = r.details ? `: ${r.details}` : '';