pr-checkmate 2.1.0 → 3.0.0

package/dist/utils/package-version.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageVersion = packageVersion;
+exports.packageName = packageName;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Our own name and version, read from the manifest that ships inside the package.
+ *
+ * Read from disk rather than baked in at build time so it is the *running* copy
+ * that answers. That distinction is the whole point: a stale global install
+ * (`npm i -g pr-checkmate`) shadows the project's own copy on `PATH`, and a repo
+ * pinned to the latest version can still be checked by a year-old binary without
+ * anything in the log saying so. One client spent a while reading an upgrade
+ * notice for a version they had already installed, because nothing printed which
+ * version was speaking.
+ *
+ * Falls back to placeholders rather than throwing: no caller here is important
+ * enough to fail a run over a manifest it could not read.
+ */
+function readManifest() {
+    try {
+        const manifest = node_path_1.default.resolve(__dirname, '../..', 'package.json');
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8'));
+        return { name: parsed.name ?? 'pr-checkmate', version: parsed.version ?? '0.0.0' };
+    }
+    catch {
+        return { name: 'pr-checkmate', version: '0.0.0' };
+    }
+}
+/** The version of pr-checkmate that is executing right now. */
+function packageVersion() {
+    return readManifest().version;
+}
+/** The package name that is executing right now — the one to query npm for. */
+function packageName() {
+    return readManifest().name;
+}

package/dist/utils/resolve-bin.d.ts

@@ -1,16 +1,66 @@
+/** Where a tool was found, in the order the candidates are tried. */
+export type ToolSource = 'client' | 'profile' | 'bundled';
+/** A resolved tool binary, and which copy of it answered. */
+export interface ResolvedTool {
+    bin: string;
+    source: ToolSource;
+    /** The search root that produced it; `undefined` for module-relative resolution. */
+    root?: string;
+}
+/**
+ * Point tool resolution at the profile directories fetched for this run.
+ *
+ * Called by the install layer once the cache is known. Passing an empty list —
+ * or never calling it at all — leaves resolution exactly as it was before
+ * profiles existed, which is what keeps a run that needs no fetching identical
+ * to a run from before there was anything to fetch.
+ */
+export declare function registerToolPaths(dirs: string[]): void;
+/** Drop every registered profile root. For tests, and for a second run in-process. */
+export declare function clearToolPaths(): void;
+/** The root of the installed pr-checkmate package — where our own tooling lives. */
+export declare function ownPackageRoot(): string;
+/**
+ * Whether a package is physically present in our own dependency tree.
+ *
+ * Checked by walking `node_modules` upwards rather than by `require.resolve`,
+ * because a package that restricts its `exports` map resolves for neither its
+ * main entry nor its `package.json` while being perfectly well installed —
+ * `cspell` is one. The question here is only "is it there", and the directory
+ * answers that without an opinion about what it chooses to export.
+ *
+ * Walking up matters as much as the check itself: installed as a dependency, our
+ * own packages are hoisted to the client's `node_modules`, one level above ours.
+ */
+export declare function packagePresent(pkgName: string, from?: string): boolean;
+/**
+ * Resolve a tool's binary and say which copy answered.
+ *
+ * Use this over {@link resolvePackageBin} when the answer is worth logging — the
+ * source is the difference between "the client's ESLint 8 ran" and "ours did",
+ * and that is the first thing anyone asks when a lint result looks wrong.
+ *
+ * @param pkgName Package whose binary to resolve (e.g. `eslint`).
+ * @param binRelPath Bin path relative to the package root (e.g. `bin/eslint.js`).
+ * @param options Resolution options.
+ * @param options.paths Roots to prefer ahead of everything else. Use
+ *   `[process.cwd()]` to prefer the consumer project's copy.
+ */
+export declare function resolveTool(pkgName: string, binRelPath: string, options?: {
+    paths?: string[];
+}): ResolvedTool | null;
 /**
  * Resolves a binary path for a bundled package, bypassing exports map restrictions.
  *
- * Strategy (tries each in order):
- * 1. Direct subpath — fast path for packages that explicitly export their bin
- * 2. Via package.json — for packages that export ./package.json but not the bin subpath (e.g. eslint)
- * 3. Walk up from main entry — for packages that export neither (e.g. cspell)
+ * Throws when no copy can be found anywhere, which is the honest outcome: a check
+ * that cannot find its tool has nothing to report, and the install layer turns
+ * that into a skip with a reason rather than letting it surface as a stack trace.
  *
  * @param pkgName - The package whose binary to resolve (e.g. `eslint`).
  * @param binRelPath - The bin path relative to the package root (e.g. `bin/eslint.js`).
  * @param options - Resolution options.
- * @param options.paths - Directories to resolve from (passed to `require.resolve`).
- *   Use `[process.cwd()]` to prefer the consumer project's copy of the package.
+ * @param options.paths - Directories to resolve from, preferred over everything
+ *   else. Use `[process.cwd()]` to prefer the consumer project's copy.
  */
 export declare function resolvePackageBin(pkgName: string, binRelPath: string, options?: {
     paths?: string[];

package/dist/utils/resolve-bin.js

@@ -3,51 +3,161 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerToolPaths = registerToolPaths;
+exports.clearToolPaths = clearToolPaths;
+exports.ownPackageRoot = ownPackageRoot;
+exports.packagePresent = packagePresent;
+exports.resolveTool = resolveTool;
 exports.resolvePackageBin = resolvePackageBin;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 /**
- * Resolves a binary path for a bundled package, bypassing exports map restrictions.
+ * Extra roots to search, registered once per run by the install layer.
  *
- * Strategy (tries each in order):
- * 1. Direct subpath — fast path for packages that explicitly export their bin
- * 2. Via package.json — for packages that export ./package.json but not the bin subpath (e.g. eslint)
- * 3. Walk up from main entry — for packages that export neither (e.g. cspell)
+ * Module state rather than a parameter threaded through fifteen call sites: a
+ * profile directory is a property of the *run*, not of any one check, and every
+ * check that resolves a binary would otherwise have to be handed a value it has
+ * no opinion about. `registerToolPaths` is called before the first check starts
+ * and never during one, so nothing observes it changing underneath.
+ */
+let profileRoots = [];
+/**
+ * Point tool resolution at the profile directories fetched for this run.
  *
- * @param pkgName - The package whose binary to resolve (e.g. `eslint`).
- * @param binRelPath - The bin path relative to the package root (e.g. `bin/eslint.js`).
- * @param options - Resolution options.
- * @param options.paths - Directories to resolve from (passed to `require.resolve`).
- *   Use `[process.cwd()]` to prefer the consumer project's copy of the package.
+ * Called by the install layer once the cache is known. Passing an empty list —
+ * or never calling it at all — leaves resolution exactly as it was before
+ * profiles existed, which is what keeps a run that needs no fetching identical
+ * to a run from before there was anything to fetch.
  */
-function resolvePackageBin(pkgName, binRelPath, options) {
-    const resolveOpts = options?.paths ? { paths: options.paths } : undefined;
-    // 1. Direct subpath
+function registerToolPaths(dirs) {
+    profileRoots = [...dirs];
+}
+/** Drop every registered profile root. For tests, and for a second run in-process. */
+function clearToolPaths() {
+    profileRoots = [];
+}
+/** The root of the installed pr-checkmate package — where our own tooling lives. */
+function ownPackageRoot() {
+    return node_path_1.default.resolve(__dirname, '../..');
+}
+/**
+ * Whether a package is physically present in our own dependency tree.
+ *
+ * Checked by walking `node_modules` upwards rather than by `require.resolve`,
+ * because a package that restricts its `exports` map resolves for neither its
+ * main entry nor its `package.json` while being perfectly well installed —
+ * `cspell` is one. The question here is only "is it there", and the directory
+ * answers that without an opinion about what it chooses to export.
+ *
+ * Walking up matters as much as the check itself: installed as a dependency, our
+ * own packages are hoisted to the client's `node_modules`, one level above ours.
+ */
+function packagePresent(pkgName, from = ownPackageRoot()) {
+    let dir = from;
+    while (dir !== node_path_1.default.dirname(dir)) {
+        if (node_fs_1.default.existsSync(node_path_1.default.join(dir, 'node_modules', pkgName, 'package.json')))
+            return true;
+        dir = node_path_1.default.dirname(dir);
+    }
+    return false;
+}
+/** One resolution attempt against a single set of search paths. */
+function tryResolve(pkgName, binRelPath, paths) {
+    const resolveOpts = paths ? { paths } : undefined;
+    // 1. Direct subpath — the fast path for packages that export their bin.
     try {
         return require.resolve(`${pkgName}/${binRelPath}`, resolveOpts);
     }
     catch { }
-    // 2. Via package.json
+    // 2. Via package.json — for packages that export `./package.json` but not the
+    //    bin subpath (eslint).
     try {
         const pkgJsonPath = require.resolve(`${pkgName}/package.json`, resolveOpts);
         return node_path_1.default.join(node_path_1.default.dirname(pkgJsonPath), binRelPath);
     }
     catch { }
-    // 3. Walk up from main entry to find package root by matching package name
-    const main = require.resolve(pkgName, resolveOpts);
-    let dir = node_path_1.default.dirname(main);
-    while (dir !== node_path_1.default.dirname(dir)) {
-        const pkgJsonPath = node_path_1.default.join(dir, 'package.json');
-        if (node_fs_1.default.existsSync(pkgJsonPath)) {
-            try {
-                const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
-                if (pkg.name === pkgName) {
-                    return node_path_1.default.join(dir, binRelPath);
+    // 3. Walk up from the main entry, matching the package name — for packages
+    //    that export neither (cspell).
+    try {
+        let dir = node_path_1.default.dirname(require.resolve(pkgName, resolveOpts));
+        while (dir !== node_path_1.default.dirname(dir)) {
+            const pkgJsonPath = node_path_1.default.join(dir, 'package.json');
+            if (node_fs_1.default.existsSync(pkgJsonPath)) {
+                try {
+                    const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
+                    if (pkg.name === pkgName)
+                        return node_path_1.default.join(dir, binRelPath);
                 }
+                catch { }
             }
-            catch { }
+            dir = node_path_1.default.dirname(dir);
         }
-        dir = node_path_1.default.dirname(dir);
     }
+    catch { }
+    return null;
+}
+/**
+ * The roots to try, in order, and what finding a tool in each one means.
+ *
+ * The order is the policy, and it is deliberate:
+ *
+ * 1. **The client's own copy**, when a caller asked for it. A repository pinned
+ *    to ESLint 8 with a legacy `.eslintrc` must keep working, and only its copy
+ *    can do that.
+ * 2. **A fetched profile**, for tooling that does not ship inside the package.
+ * 3. **Our bundle** — module-relative, exactly as resolution worked before
+ *    profiles existed.
+ *
+ * Branch 3 is passed `undefined` rather than our package root on purpose: that is
+ * literally the previous behaviour, so a run with nothing registered resolves
+ * every tool along the identical path it always did.
+ */
+function candidates(optPaths) {
+    const list = [];
+    if (optPaths && optPaths.length > 0)
+        list.push({ paths: optPaths, source: 'client' });
+    for (const root of profileRoots)
+        list.push({ paths: [root], source: 'profile' });
+    list.push({ source: 'bundled' });
+    return list;
+}
+/**
+ * Resolve a tool's binary and say which copy answered.
+ *
+ * Use this over {@link resolvePackageBin} when the answer is worth logging — the
+ * source is the difference between "the client's ESLint 8 ran" and "ours did",
+ * and that is the first thing anyone asks when a lint result looks wrong.
+ *
+ * @param pkgName Package whose binary to resolve (e.g. `eslint`).
+ * @param binRelPath Bin path relative to the package root (e.g. `bin/eslint.js`).
+ * @param options Resolution options.
+ * @param options.paths Roots to prefer ahead of everything else. Use
+ *   `[process.cwd()]` to prefer the consumer project's copy.
+ */
+function resolveTool(pkgName, binRelPath, options) {
+    for (const candidate of candidates(options?.paths)) {
+        const bin = tryResolve(pkgName, binRelPath, candidate.paths);
+        if (bin)
+            return { bin, source: candidate.source, root: candidate.paths?.[0] };
+    }
+    return null;
+}
+/**
+ * Resolves a binary path for a bundled package, bypassing exports map restrictions.
+ *
+ * Throws when no copy can be found anywhere, which is the honest outcome: a check
+ * that cannot find its tool has nothing to report, and the install layer turns
+ * that into a skip with a reason rather than letting it surface as a stack trace.
+ *
+ * @param pkgName - The package whose binary to resolve (e.g. `eslint`).
+ * @param binRelPath - The bin path relative to the package root (e.g. `bin/eslint.js`).
+ * @param options - Resolution options.
+ * @param options.paths - Directories to resolve from, preferred over everything
+ *   else. Use `[process.cwd()]` to prefer the consumer project's copy.
+ */
+function resolvePackageBin(pkgName, binRelPath, options) {
+    const resolved = resolveTool(pkgName, binRelPath, options);
+    if (resolved)
+        return resolved.bin;
     throw new Error(`Cannot resolve binary "${binRelPath}" for package "${pkgName}"`);
 }

package/dist/utils/update-notifier.js

@@ -1,16 +1,12 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isMajorUpgrade = isMajorUpgrade;
 exports.getUpdateNotice = getUpdateNotice;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 // Imported from the module rather than the `../config` barrel on purpose:
 // `config/index.ts` imports `../utils`, so going through the barrel would make
 // utils ⇄ config circular. `constants.ts` itself pulls in nothing from utils.
 const constants_1 = require("../config/constants");
+const package_version_1 = require("./package-version");
 // Same widths as the run summary in `reporters.ts`, so the two boxes line up
 // when both are printed at the end of a run.
 const NOTICE_BORDER = '═'.repeat(63);
@@ -72,8 +68,10 @@ async function getUpdateNotice(timeoutMs = 2500) {
     if (process.env.PR_CHECKMATE_NO_UPDATE_CHECK)
         return null;
     try {
-        const pkgPath = node_path_1.default.resolve(__dirname, '../..', 'package.json');
-        const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgPath, 'utf-8'));
+        // The *running* copy's identity, not the project's declared dependency. A
+        // stale global install shadows the local one on `PATH`, and it is the stale
+        // copy that must own the notice it prints.
+        const pkg = { name: (0, package_version_1.packageName)(), version: (0, package_version_1.packageVersion)() };
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         let latest;

package/gitleaks.toml

@@ -3,6 +3,20 @@ title = "pr-checkmate gitleaks config"
 [extend]
 useDefault = true
 
+# THIS FILE SHIPS, AND IT IS APPLIED TO EVERY CLIENT WITHOUT A GITLEAKS CONFIG OF
+# THEIR OWN. Read `src/core/checks/security/security.ts`: `--config` points here
+# whenever `hasLocalConfig` finds nothing in the repository being scanned.
+#
+# So an entry added here to quieten OUR OWN corpus silences it for everybody. That
+# was measured, not imagined: adding `tests/` to the paths below removed six real
+# `Generic API Key` findings from a client repository — under
+# `packages/commons/tests/`, `packages/node/tests/`, and three more — in a check
+# that BLOCKS. Our own noise is never a reason to widen this list; use
+# `.gitleaksignore` in this repository instead, which does not ship.
+#
+# `__tests__` predates that and is left alone: it is a convention for a directory
+# of test files specifically, not a whole path segment named `test`.
+
 [allowlist]
 description = "pr-checkmate global allowlist"
 paths = [

package/install-manifests/go/package-lock.json

@@ -0,0 +1,24 @@
+{
+  "name": "pr-checkmate-profile-go",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pr-checkmate-profile-go",
+      "version": "1.0.0",
+      "dependencies": {
+        "@wasm-fmt/gofmt": "0.7.3"
+      }
+    },
+    "node_modules/@wasm-fmt/gofmt": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/@wasm-fmt/gofmt/-/gofmt-0.7.3.tgz",
+      "integrity": "sha512-nzVTwMxHDOYrHonT7DzjqicbaTYOYPNYeXKPJnDrVUbJjx67Sg/LS1uzlOTWKToGMF8Y8l0u7G5/5Q3/8nHMMA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.17.0"
+      }
+    }
+  }
+}

package/install-manifests/go/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pr-checkmate-profile-go",
+  "version": "1.0.0",
+  "dependencies": {
+    "@wasm-fmt/gofmt": "0.7.3"
+  },
+  "private": true
+}

package/install-manifests/pytypes/package-lock.json

@@ -0,0 +1,45 @@
+{
+  "name": "pr-checkmate-profile-pytypes",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pr-checkmate-profile-pytypes",
+      "version": "1.0.0",
+      "dependencies": {
+        "pyright": "1.1.413"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/pyright": {
+      "version": "1.1.413",
+      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.413.tgz",
+      "integrity": "sha512-1lpxKrh0DHHpfAQOfciZo2ojua2jase3wwO9at8kldc+F/p1PBscxA5CQ3G1qg5lMOMhXo6ZaiMLMXEAqADIAg==",
+      "license": "MIT",
+      "bin": {
+        "pyright": "index.js",
+        "pyright-langserver": "langserver.index.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    }
+  }
+}

package/install-manifests/pytypes/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pr-checkmate-profile-pytypes",
+  "version": "1.0.0",
+  "dependencies": {
+    "pyright": "1.1.413"
+  },
+  "private": true
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "2.1.0",
+    "version": "3.0.0",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -52,7 +52,7 @@
         "spellcheck": "cspell '**/*.{ts,tsx,js,jsx,md,json}' --no-progress",
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
-        "test": "node --require ts-node/register --test --test-timeout=60000 --test-concurrency=1 \"tests/**/*.test.ts\"",
+        "test": "node --require ts-node/register --test --test-timeout=60000 \"tests/**/*.test.ts\"",
         "test:ci": "bash scripts/test-per-file.sh",
         "verify:tarball": "bash scripts/verify-tarball.sh",
         "security-scan": "npx pr-checkmate security",
@@ -82,6 +82,7 @@
         "@typescript-eslint/eslint-plugin": "^8.62.1",
         "@typescript-eslint/parser": "^8.62.1",
         "@wasm-fmt/clang-format": "^22.1.8",
+        "@wasm-fmt/gofmt": "^0.7.3",
         "cspell": "^10.0.1",
         "dpdm": "^4.2.0",
         "eslint": "^10.6.0",
@@ -106,6 +107,7 @@
     "devDependencies": {
         "conventional-commits-filter": "^5.0.0",
         "conventional-commits-parser": "^6.4.0",
+        "pyright": "^1.1.413",
         "standard-version": "^9.5.0",
         "typedoc": "^0.28.20"
     },

package/pr-checkmate.schema.json

@@ -727,7 +727,7 @@
           "default": 1
         },
         "reuseLocal": {
-          "description": "Reuse a tool already in the client's node_modules: \"compatible\" (default), \"always\", or \"off\".",
+          "description": "Reuse a tool already present in the repository's node_modules instead of our copy. \"compatible\" (default) reuses when the major matches ours, or when the tool reads the repository's own config (a legacy .eslintrc can only be read by the ESLint that wrote it, and a tsconfig by its own compiler). \"always\" reuses across a major gap at your own risk. \"off\" always uses our pinned copy, for reproducibility.",
           "type": "string",
           "enum": ["compatible", "always", "off"],
           "default": "compatible"
@@ -761,7 +761,7 @@
           "default": "~/.cache/pr-checkmate"
         },
         "prewarm": {
-          "description": "Warm the cache in postinstall. false leaves everything to the lazy path.",
+          "description": "NOT YET IMPLEMENTED — accepted and ignored. Warming the cache needs a postinstall hook, and there is nothing to warm while every profile's tooling ships inside the package; the hook lands with the dependency extraction (ticket 064, release 2). Documented as inert rather than quietly doing nothing.",
           "type": "boolean",
           "default": true
         },
@@ -1174,6 +1174,12 @@
               }
             }
           }
+        },
+        "dataflowWindow": {
+          "type": "integer",
+          "minimum": 0,
+          "default": 10,
+          "description": "Added lines a value stays tainted for, connecting an interpolated string assigned on one line to a query on a later line. 0 disables the cross-line heuristic. Advisory only — it has no scopes and no reassignment tracking, so it never blocks a run."
         }
       }
     },