pr-checkmate 2.1.0 → 2.1.2

package/README.md

@@ -143,11 +143,12 @@ machine — ShellCheck among them — are inside, so they stop silently skipping
 version tag (`:2.0.0`) for a reproducible pipeline; `--user` keeps files that formatters
 rewrite owned by you rather than by root.
 
-Verify what you pulled — the image carries build provenance signed by the workflow
-that produced it:
+Verify what you pulled — the image carries SLSA provenance and an SBOM, attached to
+the image itself in the registry:
 
 ```bash
-gh attestation verify oci://ghcr.io/mybono/pr-checkmate:2 --owner Mybono
+docker buildx imagetools inspect ghcr.io/mybono/pr-checkmate:2 \
+  --format '{{ json .Provenance }}'
 ```
 
 [All tags →](https://github.com/users/Mybono/packages/container/package/pr-checkmate)

package/dist/config/constants.d.ts

@@ -70,6 +70,13 @@ export declare const CONFIG_FILE_PATTERNS: string[];
  * config/CI YAML and JSON out of the report — they are data, not code, and their
  * repetition is not meaningful duplication. This mirrors the code-only file set the
  * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ *
+ * One entry per language pr-checkmate detects, all of them verified against the
+ * jscpd binary rather than assumed: the list used to stop at C++ while the check
+ * only ever handed jscpd `.ts`/`.js` files, so the Go, Rust, C#, Ruby and PHP
+ * halves were unreachable and the Python one was decoration. Copy-paste is a
+ * language-independent smell, and the tokenizer behind this check has always been
+ * able to see it — the file list was the only thing in the way.
  */
 export declare const DUPLICATE_CODE_FORMATS: string[];
 /**

package/dist/config/constants.js

@@ -192,6 +192,13 @@ exports.CONFIG_FILE_PATTERNS = [
  * config/CI YAML and JSON out of the report — they are data, not code, and their
  * repetition is not meaningful duplication. This mirrors the code-only file set the
  * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ *
+ * One entry per language pr-checkmate detects, all of them verified against the
+ * jscpd binary rather than assumed: the list used to stop at C++ while the check
+ * only ever handed jscpd `.ts`/`.js` files, so the Go, Rust, C#, Ruby and PHP
+ * halves were unreachable and the Python one was decoration. Copy-paste is a
+ * language-independent smell, and the tokenizer behind this check has always been
+ * able to see it — the file list was the only thing in the way.
  */
 exports.DUPLICATE_CODE_FORMATS = [
     'javascript',
@@ -203,6 +210,11 @@ exports.DUPLICATE_CODE_FORMATS = [
     'swift',
     'c',
     'cpp',
+    'csharp',
+    'go',
+    'php',
+    'ruby',
+    'rust',
 ];
 /**
  * File extensions to check

package/dist/core/checks/dependencies/dependency-check.js

@@ -106,7 +106,7 @@ exports.dependencyCheck = {
     applies(ctx) {
         if (ctx.config.dependency?.enabled === false)
             return false;
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // Resolve the bundled knip binary and run it via the current node — never

package/dist/core/checks/dependencies/license-check.js

@@ -1,11 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseCheck = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
@@ -19,7 +14,7 @@ exports.licenseCheck = {
     name: 'License Check',
     phase: 'blocking',
     applies(ctx) {
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);

package/dist/core/checks/dependencies/npm-audit.js

@@ -34,7 +34,7 @@ exports.npmAuditCheck = {
     applies(ctx) {
         if (ctx.config.security?.['npm-audit']?.enabled === false)
             return false;
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // `high`, not `moderate`. A moderate CVE in a direct dependency often has no

package/dist/core/checks/dependencies/outdated-deps.js

@@ -1,11 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.outdatedDepsCheck = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const types_1 = require("../../types");
@@ -16,7 +11,7 @@ exports.outdatedDepsCheck = {
     applies(ctx) {
         if (ctx.config.outdatedDeps?.enabled === false)
             return false;
-        return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+        return (0, types_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // `npm outdated` queries the registry for every dependency and can take a

package/dist/core/checks/quality/duplicate-check.js

@@ -7,6 +7,37 @@ const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+/**
+ * The files to hand jscpd, per language.
+ *
+ * This map is why the check reads `ctx.languages` at all. It used to pass a fixed
+ * `*.ts,*.tsx,*.js,*.jsx` and gate itself on TypeScript/JavaScript, so a Python
+ * repository got `⏭️ Duplicate Code: no relevant files` — not because it had no
+ * duplication, but because nothing ever looked. The formats list in `constants.ts`
+ * named Python and C++ all along, which made the report's own claim untrue.
+ *
+ * Extensions mirror `detect-language.ts` so a language that decides the check runs
+ * is a language whose files it actually scans, with one deliberate addition: `.c`
+ * and `.h` under `cpp`, since a C project detects as `cpp` and the `c` format is
+ * one jscpd supports.
+ */
+const LANGUAGE_GLOBS = {
+    typescript: ['*.ts', '*.tsx'],
+    javascript: ['*.js', '*.jsx', '*.mjs', '*.cjs'],
+    python: ['*.py'],
+    cpp: ['*.cpp', '*.cc', '*.cxx', '*.c++', '*.hpp', '*.hh', '*.hxx', '*.c', '*.h'],
+    swift: ['*.swift'],
+    kotlin: ['*.kt', '*.kts', '*.java'],
+    go: ['*.go'],
+    rust: ['*.rs'],
+    csharp: ['*.cs'],
+    ruby: ['*.rb'],
+    php: ['*.php'],
+};
+/** The scan globs for one run: every detected language jscpd can tokenise. */
+function globsFor(languages) {
+    return [...new Set(languages.flatMap(lang => LANGUAGE_GLOBS[lang] ?? []))];
+}
 // Always excluded regardless of client config — scanning these never yields
 // meaningful production duplication. Config files (eslint/*.config.*) are data,
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
@@ -36,12 +67,12 @@ exports.duplicateCheck = {
     applies(ctx) {
         if (ctx.config.duplicate?.enabled === false)
             return false;
-        return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
+        return globsFor(ctx.languages).length > 0;
     },
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)());
         if (targetPaths === null)
             return (0, types_1.skip)('git unavailable');
         if (targetPaths.length === 0)

package/dist/core/install/doctor.d.ts

@@ -1,8 +1,8 @@
 import { type LanguageUsage } from '../../utils/detect-language';
+import { packageVersion } from '../../utils/package-version';
 import { type EnsureResult } from './ensure';
 import { type ProfileDecision } from './profiles';
-/** Our own version, read from the package manifest that ships with us. */
-export declare function packageVersion(): string;
+export { packageVersion };
 /**
  * Everything the install layer knows about this repository, in one shot.
  *

package/dist/core/install/doctor.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.packageVersion = packageVersion;
+exports.packageVersion = void 0;
 exports.planInstall = planInstall;
 exports.installProfiles = installProfiles;
 exports.runDoctor = runDoctor;
@@ -13,19 +13,11 @@ const node_path_1 = __importDefault(require("node:path"));
 const loader_1 = require("../../config/loader");
 const detect_language_1 = require("../../utils/detect-language");
 const logger_1 = require("../../utils/logger");
+const package_version_1 = require("../../utils/package-version");
+Object.defineProperty(exports, "packageVersion", { enumerable: true, get: function () { return package_version_1.packageVersion; } });
 const cache_1 = require("./cache");
 const ensure_1 = require("./ensure");
 const profiles_1 = require("./profiles");
-/** Our own version, read from the package manifest that ships with us. */
-function packageVersion() {
-    try {
-        const manifest = node_path_1.default.resolve(__dirname, '../../..', 'package.json');
-        return JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8')).version ?? '0.0.0';
-    }
-    catch {
-        return '0.0.0';
-    }
-}
 /**
  * Everything the install layer knows about this repository, in one shot.
  *
@@ -36,7 +28,7 @@ function packageVersion() {
 async function planInstall(cwd = process.cwd(), usage) {
     const config = (0, loader_1.loadProjectConfig)();
     const detected = usage ?? (await (0, detect_language_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect));
-    const location = (0, cache_1.resolveCacheDir)(packageVersion(), config.install?.cacheDir);
+    const location = (0, cache_1.resolveCacheDir)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
     return { decisions: (0, profiles_1.planProfiles)(detected, config), cacheDir: location?.dir ?? null };
 }
 /** Whether a profile's tooling is present in the cache right now. */
@@ -71,7 +63,7 @@ async function installProfiles(cwd = process.cwd(), all = false) {
     // packages fight over npm's cache and gain nothing; the wall-clock cost lands
     // once, on a cold cache, and clarity of the log matters more there.
     for (const profile of wanted) {
-        results.push(await (0, ensure_1.ensureProfile)(profile, { cwd, version: packageVersion(), install }));
+        results.push(await (0, ensure_1.ensureProfile)(profile, { cwd, version: (0, package_version_1.packageVersion)(), install }));
     }
     return results;
 }
@@ -90,7 +82,7 @@ async function runDoctor(cwd = process.cwd()) {
     const lines = [];
     lines.push('PR CheckMate — install doctor');
     lines.push('');
-    lines.push(`  version    ${packageVersion()}`);
+    lines.push(`  version    ${(0, package_version_1.packageVersion)()}`);
     lines.push(`  repository ${cwd}`);
     lines.push(`  cache      ${cacheDir ?? 'unavailable (no writable directory)'}`);
     lines.push(`  strategy   ${config.install?.strategy ?? 'adaptive'}`);
@@ -116,7 +108,7 @@ async function runDoctor(cwd = process.cwd()) {
         lines.push(`  ${missing.length} profile(s) not installed yet. They are fetched on the next`);
         lines.push('  run, or now with: npx pr-checkmate install');
     }
-    const stale = (0, cache_1.stalePaths)(packageVersion(), config.install?.cacheDir);
+    const stale = (0, cache_1.stalePaths)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length > 0) {
         lines.push('');
         lines.push(`  ${stale.length} directory(ies) from other versions: npx pr-checkmate cache-prune`);
@@ -126,7 +118,7 @@ async function runDoctor(cwd = process.cwd()) {
 /** Remove cached tooling belonging to other versions of pr-checkmate. */
 function pruneCache() {
     const config = (0, loader_1.loadProjectConfig)();
-    const stale = (0, cache_1.stalePaths)(packageVersion(), config.install?.cacheDir);
+    const stale = (0, cache_1.stalePaths)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length === 0) {
         logger_1.logger.print('Nothing to prune — no tooling from other versions is cached.');
         return;

package/dist/core/reporters.js

@@ -8,6 +8,7 @@ exports.report = report;
 const node_fs_1 = __importDefault(require("node:fs"));
 const utils_1 = require("../utils");
 const http_1 = require("../utils/http");
+const package_version_1 = require("../utils/package-version");
 const STATUS_ICON = {
     pass: '✅',
     warn: '⚠️',
@@ -74,7 +75,7 @@ function buildMarkdownReport(report, cfg = {}) {
         // Say so rather than letting the table quietly disagree with the counts above.
         ...(hidden > 0 ? ['', `_${hidden} row(s) hidden by \`reporter.include\`._`] : []),
         '',
-        '_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate)_',
+        `_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate) v${(0, package_version_1.packageVersion)()}_`,
     ].join('\n');
 }
 /**
@@ -89,7 +90,12 @@ function printStdout(report, cfg) {
     const { passed, warned, failed, skipped } = report.summary;
     utils_1.logger.print('');
     utils_1.logger.print(SUMMARY_BORDER);
-    utils_1.logger.print('  PR CheckMate Summary');
+    // The version belongs in the headline, not in a footnote. Which copy of
+    // pr-checkmate produced a report is the first thing to establish when the
+    // report disagrees with what someone expects, and it is not otherwise
+    // recoverable from the log: a stale global install answers `pr-checkmate` on
+    // `PATH` ahead of the project's own, and reads the same config while doing it.
+    utils_1.logger.print(`  PR CheckMate Summary  ·  v${(0, package_version_1.packageVersion)()}`);
     utils_1.logger.print(SUMMARY_BORDER);
     for (const r of report.results) {
         const details = r.details ? `: ${r.details}` : '';

package/dist/core/types.d.ts

@@ -164,6 +164,24 @@ export declare const pass: (details?: string) => CheckOutcome;
 export declare const warn: (details: string) => CheckOutcome;
 export declare const fail: (details: string) => CheckOutcome;
 export declare const skip: (details: string) => CheckOutcome;
+/**
+ * Whether this repository is an npm project — the gate for every check that reads
+ * the npm dependency tree (NPM Audit, Dependencies, License Check, Outdated Deps).
+ *
+ * A `package.json` on its own is not the answer, and this is the one predicate
+ * where that matters most: installing pr-checkmate as a devDependency *creates*
+ * that file. Gate on it alone and a Python service gets four rows auditing the
+ * dependency tree of the tool auditing it — `npm audit` over our own transitive
+ * packages, licences of our own `node_modules`, "outdated" versions of tooling
+ * the team never chose. All four are unactionable by construction: nothing in the
+ * repository's own code can change any of them.
+ *
+ * So both halves must hold — a manifest to read, and JavaScript or TypeScript
+ * actually written here. A polyglot repository (a Django backend with a JS
+ * frontend) satisfies both and keeps every check; a Python repository whose only
+ * `package.json` is the one that installed us satisfies neither.
+ */
+export declare function isNpmProject(ctx: CheckContext): boolean;
 /**
  * Identity helper for authoring a `Check` with full type inference and checking.
  * Purely ergonomic — `defineCheck({ ... })` is equivalent to `{ ... } satisfies Check`.

package/dist/core/types.js

@@ -1,6 +1,12 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.defineCheck = exports.skip = exports.fail = exports.warn = exports.pass = exports.PHASES = void 0;
+exports.isNpmProject = isNpmProject;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 exports.PHASES = ['blocking', 'informational', 'format'];
 /** Outcome constructors — keep check bodies terse. */
 const pass = (details) => ({
@@ -14,6 +20,28 @@ const fail = (details) => ({ status: 'fail', details });
 exports.fail = fail;
 const skip = (details) => ({ status: 'skip', details });
 exports.skip = skip;
+/**
+ * Whether this repository is an npm project — the gate for every check that reads
+ * the npm dependency tree (NPM Audit, Dependencies, License Check, Outdated Deps).
+ *
+ * A `package.json` on its own is not the answer, and this is the one predicate
+ * where that matters most: installing pr-checkmate as a devDependency *creates*
+ * that file. Gate on it alone and a Python service gets four rows auditing the
+ * dependency tree of the tool auditing it — `npm audit` over our own transitive
+ * packages, licences of our own `node_modules`, "outdated" versions of tooling
+ * the team never chose. All four are unactionable by construction: nothing in the
+ * repository's own code can change any of them.
+ *
+ * So both halves must hold — a manifest to read, and JavaScript or TypeScript
+ * actually written here. A polyglot repository (a Django backend with a JS
+ * frontend) satisfies both and keeps every check; a Python repository whose only
+ * `package.json` is the one that installed us satisfies neither.
+ */
+function isNpmProject(ctx) {
+    if (!ctx.languages.includes('javascript') && !ctx.languages.includes('typescript'))
+        return false;
+    return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
+}
 /**
  * Identity helper for authoring a `Check` with full type inference and checking.
  * Purely ergonomic — `defineCheck({ ... })` is equivalent to `{ ... } satisfies Check`.

package/dist/utils/detect-language.js

@@ -18,7 +18,17 @@ const logger_1 = require("./logger");
  */
 const MARKER_FILES = {
     typescript: ['tsconfig.json'],
-    javascript: ['package.json'],
+    // Deliberately empty. `package.json` used to sit here, and it is the one marker
+    // this package creates itself: installing pr-checkmate through npm puts a
+    // `package.json` in a repository that may not hold a single line of JavaScript.
+    // A Python service then detected as JavaScript and got the whole JS half of the
+    // report — ESLint, Prettier, NPM Audit, License Check — every row of it about
+    // the file that installed us. `install/profiles.ts` already refused to buy
+    // 152 MB of toolchain off this marker (ticket 064); the checks now refuse to
+    // run off it for the same reason. Real JavaScript is detected by its `.js`,
+    // `.jsx`, `.mjs` and `.cjs` files, and a repository that has none loses
+    // nothing: every JS check it lost would have reported "no files" anyway.
+    javascript: [],
     python: ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt', 'Pipfile'],
     cpp: ['CMakeLists.txt', 'compile_commands.json', 'conanfile.txt', 'conanfile.py'],
     swift: ['Package.swift', 'Package.resolved'],

package/dist/utils/index.d.ts

@@ -6,6 +6,7 @@ export * from './direct-deps';
 export * from './detect-language';
 export * from './glob';
 export * from './update-notifier';
+export * from './package-version';
 export * from './ci';
 export * from './git';
 /**

package/dist/utils/index.js

@@ -28,6 +28,7 @@ __exportStar(require("./direct-deps"), exports);
 __exportStar(require("./detect-language"), exports);
 __exportStar(require("./glob"), exports);
 __exportStar(require("./update-notifier"), exports);
+__exportStar(require("./package-version"), exports);
 __exportStar(require("./ci"), exports);
 __exportStar(require("./git"), exports);
 /**

package/dist/utils/package-version.d.ts

@@ -0,0 +1,4 @@
+/** The version of pr-checkmate that is executing right now. */
+export declare function packageVersion(): string;
+/** The package name that is executing right now — the one to query npm for. */
+export declare function packageName(): string;

package/dist/utils/package-version.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageVersion = packageVersion;
+exports.packageName = packageName;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Our own name and version, read from the manifest that ships inside the package.
+ *
+ * Read from disk rather than baked in at build time so it is the *running* copy
+ * that answers. That distinction is the whole point: a stale global install
+ * (`npm i -g pr-checkmate`) shadows the project's own copy on `PATH`, and a repo
+ * pinned to the latest version can still be checked by a year-old binary without
+ * anything in the log saying so. One client spent a while reading an upgrade
+ * notice for a version they had already installed, because nothing printed which
+ * version was speaking.
+ *
+ * Falls back to placeholders rather than throwing: no caller here is important
+ * enough to fail a run over a manifest it could not read.
+ */
+function readManifest() {
+    try {
+        const manifest = node_path_1.default.resolve(__dirname, '../..', 'package.json');
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8'));
+        return { name: parsed.name ?? 'pr-checkmate', version: parsed.version ?? '0.0.0' };
+    }
+    catch {
+        return { name: 'pr-checkmate', version: '0.0.0' };
+    }
+}
+/** The version of pr-checkmate that is executing right now. */
+function packageVersion() {
+    return readManifest().version;
+}
+/** The package name that is executing right now — the one to query npm for. */
+function packageName() {
+    return readManifest().name;
+}

package/dist/utils/update-notifier.js

@@ -1,16 +1,12 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isMajorUpgrade = isMajorUpgrade;
 exports.getUpdateNotice = getUpdateNotice;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 // Imported from the module rather than the `../config` barrel on purpose:
 // `config/index.ts` imports `../utils`, so going through the barrel would make
 // utils ⇄ config circular. `constants.ts` itself pulls in nothing from utils.
 const constants_1 = require("../config/constants");
+const package_version_1 = require("./package-version");
 // Same widths as the run summary in `reporters.ts`, so the two boxes line up
 // when both are printed at the end of a run.
 const NOTICE_BORDER = '═'.repeat(63);
@@ -72,8 +68,10 @@ async function getUpdateNotice(timeoutMs = 2500) {
     if (process.env.PR_CHECKMATE_NO_UPDATE_CHECK)
         return null;
     try {
-        const pkgPath = node_path_1.default.resolve(__dirname, '../..', 'package.json');
-        const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgPath, 'utf-8'));
+        // The *running* copy's identity, not the project's declared dependency. A
+        // stale global install shadows the local one on `PATH`, and it is the stale
+        // copy that must own the notice it prints.
+        const pkg = { name: (0, package_version_1.packageName)(), version: (0, package_version_1.packageVersion)() };
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         let latest;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "2.1.0",
+    "version": "2.1.2",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",