pr-checkmate 2.1.0 → 3.0.0

package/dist/core/checks/findings.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DATAFLOW_WINDOW = void 0;
 exports.severityEmitter = severityEmitter;
 exports.mergeSeverityBuckets = mergeSeverityBuckets;
 exports.emptyBuckets = emptyBuckets;
@@ -13,6 +14,7 @@ exports.commentSyntaxFor = commentSyntaxFor;
 exports.stripInlineComment = stripInlineComment;
 exports.stripStringLiterals = stripStringLiterals;
 exports.scanDiffPatterns = scanDiffPatterns;
+exports.logSample = logSample;
 exports.bucketTotal = bucketTotal;
 exports.reportCountedFindings = reportCountedFindings;
 exports.clientFindingOptions = clientFindingOptions;
@@ -142,16 +144,26 @@ async function scanTrackedFiles(ctx, files, onFile) {
  *
  * `onChunk` is called once per diff in delta mode and once per file in full mode,
  * which keeps a whole monorepo from being concatenated before matching starts.
+ *
+ * Returns whether the review actually happened. `false` means git could not
+ * produce a file list, and the caller has to say so rather than report a pass:
+ * a check that reviewed nothing looks exactly like a check that found nothing,
+ * and that is the whole of ticket 072. `fullScanBehaviour: "skip"` is the one
+ * case where `true` is returned having reviewed nothing on purpose — the client
+ * asked for that, so it is not a hole in coverage.
  */
 async function reviewLines(ctx, globs, onChunk) {
     if (ctx.baseSha) {
         onChunk(await diffAddedLines(ctx, globs));
-        return;
+        return true;
     }
     if (ctx.config.run?.fullScanBehaviour === 'skip')
-        return;
+        return true;
     const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.']);
+    if (files === null)
+        return false;
     await scanTrackedFiles(ctx, files, onChunk);
+    return true;
 }
 const C_LIKE_EXTENSIONS = new Set([
     'ts',
@@ -340,6 +352,94 @@ function stripStringLiterals(line) {
 }
 /** Characters kept per logged sample, so one minified added line can't flood the log. */
 const SAMPLE_MAX_LENGTH = 120;
+/**
+ * Cross-line taint tracking: the cheapest useful step beyond a per-line regex.
+ *
+ * A per-line pattern cannot see the shape that actually ships:
+ *
+ * ```ts
+ * const q = `SELECT * FROM u WHERE id=${id}`;
+ * db.query(q);
+ * ```
+ *
+ * Both halves are innocent alone — a template literal is not a query, and
+ * `query(q)` is not an interpolation — so the built-in rule, which requires the
+ * backtick *inside* the call, misses it entirely. That is the most ordinary way
+ * anyone writes an injection.
+ *
+ * This is deliberately not dataflow analysis. It remembers one thing (a variable
+ * assigned from an interpolated template literal), for a bounded number of added
+ * lines, inside one hunk, and reports when that name is handed to a query sink.
+ * No scopes, no reassignment, no function boundaries. Ticket 058 calls the
+ * ceiling out on purpose: an honest boundary beats an inflated promise, and the
+ * finding is rated `warn` because a heuristic must not block a build.
+ */
+const TAINT_DECLARATION = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*`[^`]*\$\{/;
+/** Sinks that turn a tainted string into a query. */
+const TAINT_SINKS = 'query|execute|exec|raw';
+/**
+ * How many added lines a taint survives, for the one check that asks for it.
+ *
+ * Exported because the default belongs to Diff Security, not to this function:
+ * `scanDiffPatterns` is shared by Diff Smells, Workflow Security and Dockerfile
+ * Security too, and defaulting the heuristic ON here leaked a finding labelled
+ * "SQL injection risk" into a code-smell report — under the wrong check, three
+ * times per run, off a config key (`diffSecurity.dataflowWindow`) that has no
+ * meaning for any of them. Caught by our own Diff Smells row.
+ */
+exports.DEFAULT_DATAFLOW_WINDOW = 10;
+const CROSS_LINE_SQL_LABEL = 'Interpolated value reaches a query (SQL injection risk, cross-line)';
+/** `@@ ... @@` — a new hunk, and the boundary taint never crosses. */
+const DIFF_HUNK_HEADER = /^@@ /;
+/**
+ * Whether this line hands `name` to a query sink.
+ *
+ * Built per lookup rather than cached: the set of tracked names is at most a
+ * handful per hunk, and a regex assembled from a captured identifier must not
+ * outlive the hunk that captured it.
+ */
+function reachesSink(code, name) {
+    return new RegExp(`\\b(?:${TAINT_SINKS})\\s*\\(\\s*${name}\\s*[,)]`).test(code);
+}
+/**
+ * The per-hunk taint state, kept out of {@link scanDiffPatterns} so the scan loop
+ * stays one thing: match patterns, collect findings. A tracker built with a
+ * window of `0` answers `false` to everything and records nothing, which is how
+ * the heuristic switches off without a branch at the call site.
+ */
+function taintTracker(window) {
+    let tainted = new Map();
+    let ordinal = 0;
+    return {
+        reset: () => {
+            tainted = new Map();
+            ordinal = 0;
+        },
+        inspect: (rawText, asCode) => {
+            if (window <= 0)
+                return false;
+            ordinal += 1;
+            // Sinks are looked for before new taints are recorded, so a line that both
+            // declares and consumes cannot report against itself — that shape is
+            // already covered by the built-in same-line rule.
+            let hit = false;
+            for (const [name, declaredAt] of tainted) {
+                if (ordinal - declaredAt > window) {
+                    tainted.delete(name);
+                    continue;
+                }
+                if (reachesSink(asCode, name))
+                    hit = true;
+            }
+            // Matched on the raw text: `stripStringLiterals` blanks the `${...}` that
+            // is the entire reason the value is suspect.
+            const declared = TAINT_DECLARATION.exec(rawText);
+            if (declared)
+                tainted.set(declared[1], ordinal);
+            return hit;
+        },
+    };
+}
 /** `+++ b/path/to/file.ts` — the header that says which file follows. */
 const DIFF_FILE_HEADER = /^\+\+\+ b\/(.+)$/;
 /**
@@ -368,12 +468,21 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
     let inBlockComment = false;
     // Whole files can be excluded by glob; the flag persists until the next header.
     let skippingFile = false;
+    // Cleared at every file and hunk boundary: two unrelated hunks are not two
+    // halves of one flow.
+    const taint = taintTracker(Math.max(0, opts.dataflowWindow ?? 0));
     for (const line of stdout.split('\n')) {
         const header = DIFF_FILE_HEADER.exec(line);
         if (header) {
             syntax = mode === 'language' ? commentSyntaxFor(header[1]) : 'both';
             inBlockComment = false;
             skippingFile = ignorePaths.length > 0 && (0, utils_1.matchesAnyGlob)(header[1], ignorePaths);
+            taint.reset();
+            continue;
+        }
+        // Checked before the `+` filter below, which a hunk header does not satisfy.
+        if (DIFF_HUNK_HEADER.test(line)) {
+            taint.reset();
             continue;
         }
         if (skippingFile)
@@ -393,6 +502,9 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
                 (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, SAMPLE_MAX_LENGTH));
             }
         }
+        if (taint.inspect(prepared.text, asCode)) {
+            (warnings[CROSS_LINE_SQL_LABEL] ?? (warnings[CROSS_LINE_SQL_LABEL] = [])).push(line.slice(1).trim().substring(0, SAMPLE_MAX_LENGTH));
+        }
     }
     return { errors, warnings };
 }
@@ -445,6 +557,32 @@ function stripBlockComments(line, open) {
     return { text: out, open: inside };
 }
 /** Total number of findings across all labels in a bucket. */
+/** How many findings reach the log before the rest are counted instead. */
+const MAX_LOGGED = 10;
+/**
+ * Log a capped sample of raw output lines under a one-line summary.
+ *
+ * The cap is the point: a linter with 400 offences must not push the rest of the
+ * report out of a CI log's scrollback, and the count that follows the sample is
+ * what keeps the truncation from reading as the whole story.
+ *
+ * Deliberately not the private `logFindings` below, which this nearly collided
+ * with. That one takes findings already grouped into labelled buckets and pairs
+ * the log with a severity; this one takes lines a tool printed and does nothing
+ * but show them, which is what a check wrapping somebody else's output needs and
+ * the only thing it can honestly claim about them.
+ *
+ * Here rather than beside its first caller because three categories want it now —
+ * the language runner, the Python type check, and Duplicate Code — and a
+ * `quality/` check importing from `languages/` to get a logger was the wrong
+ * shape (ticket 079).
+ */
+function logSample(name, summary, lines) {
+    utils_1.logger.warn(`[${name}]: ⚠️ ${summary}`);
+    lines.slice(0, MAX_LOGGED).forEach(line => utils_1.logger.warn(`  ${line}`));
+    if (lines.length > MAX_LOGGED)
+        utils_1.logger.warn(`  ... and ${lines.length - MAX_LOGGED} more`);
+}
 function bucketTotal(bucket) {
     return Object.values(bucket).reduce((sum, arr) => sum + arr.length, 0);
 }

package/dist/core/checks/git/custom-rules.js

@@ -89,6 +89,8 @@ exports.customRulesCheck = {
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
                 const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], ['.']);
+                if (files === null)
+                    return (0, types_1.skip)('git unavailable');
                 await (0, findings_1.scanTrackedFiles)(ctx, files, collect);
             }
             // A rule with severity "error" blocks the run (fail), regardless of phase.

package/dist/core/checks/git/diff-smell.js

@@ -50,10 +50,15 @@ exports.diffSmellCheck = {
         try {
             const { ignorePaths } = ctx.config.diffSmell ?? {};
             const found = (0, findings_1.emptyBuckets)();
-            await (0, findings_1.reviewLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], stdout => {
+            const reviewed = await (0, findings_1.reviewLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], stdout => {
                 (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.CODE_SMELLS, { ignorePaths }));
                 (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.COMMENT_SMELLS, { comments: 'off', ignorePaths }));
             });
+            // An unreadable file list is not "no smells" (ticket 072). Checked before
+            // the empty-bucket branch below, because that branch is what turned it into
+            // a green row.
+            if (!reviewed)
+                return (0, types_1.skip)('git unavailable');
             // Every smell here is declared `warn`, so nothing reaches the error bucket.
             if ((0, findings_1.bucketTotal)(found.warnings) === 0)
                 return (0, types_1.pass)();

package/dist/core/checks/git/leftover-debug.js

@@ -63,12 +63,18 @@ exports.leftoverDebugCheck = {
         try {
             const findings = {};
             const comments = ctx.config.leftoverDebug?.commentHandling ?? 'language';
+            // One failed language set fails the check — see todo-fixme, same reason.
+            let reviewed = true;
             if (ctx.languages.includes('python')) {
-                await (0, findings_1.reviewLines)(ctx, ['*.py'], out => collect(out, PYTHON_PATTERNS, findings, comments));
+                reviewed =
+                    (await (0, findings_1.reviewLines)(ctx, ['*.py'], out => collect(out, PYTHON_PATTERNS, findings, comments))) && reviewed;
             }
             if (ctx.languages.includes('kotlin')) {
-                await (0, findings_1.reviewLines)(ctx, ['*.kt', '*.kts', '*.java'], out => collect(out, KOTLIN_PATTERNS, findings, comments));
+                reviewed =
+                    (await (0, findings_1.reviewLines)(ctx, ['*.kt', '*.kts', '*.java'], out => collect(out, KOTLIN_PATTERNS, findings, comments))) && reviewed;
             }
+            if (!reviewed)
+                return (0, types_1.skip)('git unavailable');
             if ((0, findings_1.bucketTotal)(findings) === 0)
                 return (0, types_1.pass)();
             // Advisory by default; a repo may promote to a gate via

package/dist/core/checks/git/lockfile-drift.js

@@ -8,6 +8,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 const findings_1 = require("../findings");
 /**
@@ -73,6 +74,10 @@ exports.lockfileDriftCheck = {
             // Raw name-only diff — manifests/locks live at the repo root, outside any
             // configured `sourcePath`, so this deliberately does NOT scope (same as
             // the Sensitive Files guard). Scoping would hide the very files we check.
+            //
+            // `excludePaths` is still applied, below: not scoping is an argument about
+            // WHERE these files live, not a licence to ignore a client who named one
+            // (ticket 080). A vendored sub-project's lockfile is a real case.
             const { stdout } = await (0, execa_1.execa)('git', [
                 'diff',
                 '--name-only',
@@ -80,7 +85,7 @@ exports.lockfileDriftCheck = {
                 ctx.baseSha,
                 ctx.headSha ?? 'HEAD',
             ], { cwd: ctx.cwd });
-            const changed = new Set(stdout.split('\n').filter(Boolean));
+            const changed = new Set((0, targets_1.excludeClientPaths)(stdout.split('\n').filter(Boolean), ctx.cwd));
             const warnings = [];
             for (const changedPath of changed) {
                 const pair = LOCK_PAIRS.find(p => p.manifest === node_path_1.default.basename(changedPath));

package/dist/core/checks/git/merge-conflict.js

@@ -82,7 +82,7 @@ exports.mergeConflictCheck = {
         // client's `ignoreDirs` and `sourcePath`), then diff only those files for
         // content. `['*']` matches every path since conflicts are language-agnostic;
         // scoping still keeps build/vendor/report dirs out, like every other check.
-        const files = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
+        const files = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (files === null)
             return (0, types_1.skip)('git unavailable');
         if (files.length === 0)

package/dist/core/checks/git/missing-tests.js

@@ -45,7 +45,7 @@ exports.missingTestsCheck = {
     async run(ctx) {
         // Scope the same way lint does — a client's `sourcePath` and `ignoreDirs`
         // both apply, so generated/out-of-scope dirs never count as "new source".
-        const scopedList = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
+        const scopedList = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (scopedList === null)
             return (0, types_1.skip)('git unavailable');
         const scoped = new Set(scopedList);

package/dist/core/checks/git/todo-fixme.js

@@ -51,14 +51,22 @@ exports.todoFixmeCheck = {
             const keywords = cfg?.keywords ?? DEFAULT_KEYWORDS;
             const requireTicket = cfg?.requireTicket ?? false;
             const findings = {};
+            // One failed language set fails the check: a partial answer reported as a
+            // pass says the repository is clean when half of it was never read (072).
+            let reviewed = true;
             if (ctx.languages.includes('python')) {
                 const pattern = buildPattern('#', keywords);
-                await (0, findings_1.reviewLines)(ctx, ['*.py'], out => scan(out, pattern, requireTicket, findings));
+                reviewed =
+                    (await (0, findings_1.reviewLines)(ctx, ['*.py'], out => scan(out, pattern, requireTicket, findings))) &&
+                        reviewed;
             }
             if (ctx.languages.includes('kotlin')) {
                 const ktPattern = buildPattern('//|/\\*', keywords);
-                await (0, findings_1.reviewLines)(ctx, ['*.kt', '*.kts', '*.java'], out => scan(out, ktPattern, requireTicket, findings));
+                reviewed =
+                    (await (0, findings_1.reviewLines)(ctx, ['*.kt', '*.kts', '*.java'], out => scan(out, ktPattern, requireTicket, findings))) && reviewed;
             }
+            if (!reviewed)
+                return (0, types_1.skip)('git unavailable');
             if ((0, findings_1.bucketTotal)(findings) === 0)
                 return (0, types_1.pass)();
             return (0, findings_1.reportCountedFindings)(findings, ctx, {

package/dist/core/checks/languages/cpp-format.js

@@ -6,8 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cppFormatCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 /**
  * C/C++ source & header extensions clang-format understands. `.h` is intentionally
@@ -27,46 +29,6 @@ function resolveStyleArg(ctx) {
     const style = ctx.config.cpp?.clangFormat?.style ?? DEFAULT_STYLE;
     return `--style=${style}`;
 }
-/**
- * Returns the C/C++ files to check. Uses the PR diff range when available
- * (delta mode), else scans all tracked C/C++ files. Returns an empty array
- * when there is nothing to check, `null` when git is unusable.
- */
-async function resolveTargets(ctx) {
-    try {
-        if (ctx.baseSha) {
-            const { stdout } = await (0, execa_1.execa)('git', [
-                'diff',
-                '--name-only',
-                '--diff-filter=ACMR',
-                ctx.baseSha,
-                ctx.headSha ?? 'HEAD',
-                '--',
-                ...CPP_GLOBS,
-            ], { cwd: ctx.cwd, reject: false });
-            const files = stdout
-                .split('\n')
-                .map(f => f.trim())
-                .filter(Boolean);
-            utils_1.logger.info(`[C++ Format]: 📂 Delta mode: ${files.length} changed C/C++ file(s)`);
-            return files;
-        }
-        const { stdout } = await (0, execa_1.execa)('git', ['ls-files', ...CPP_GLOBS], {
-            cwd: ctx.cwd,
-            reject: false,
-        });
-        const files = stdout
-            .split('\n')
-            .map(f => f.trim())
-            .filter(Boolean);
-        utils_1.logger.info(`[C++ Format]: Full scan: ${files.length} tracked C/C++ file(s)`);
-        return files;
-    }
-    catch (err) {
-        utils_1.logger.warn(`[C++ Format]: ⚠️ Could not list C/C++ files\n${err}`);
-        return null;
-    }
-}
 /** Counts distinct files flagged in clang-format's `--dry-run --Werror` diagnostics. */
 function countOffendingFiles(stderr) {
     const files = new Set();
@@ -89,7 +51,14 @@ exports.cppFormatCheck = {
         return ctx.config.cpp?.enabled !== false && ctx.languages.includes('cpp');
     },
     async run(ctx) {
-        const targets = await resolveTargets(ctx);
+        // Through `targets.ts`, not `git` directly. This check used to run its own
+        // `git ls-files`, which is the one mistake the authoring guide exists to
+        // prevent: it inherits neither `ignoreDirs` nor `sourcePath`. On a real C++
+        // repository that meant 403 files including a vendored copy of OpenCV — and
+        // in `write` mode clang-format was rewriting third-party sources the client
+        // does not own. It also crashed the WASM formatter, which is how this was
+        // found.
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, CPP_GLOBS, (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
@@ -112,7 +81,15 @@ exports.cppFormatCheck = {
         });
         if (fix.exitCode !== 0) {
             utils_1.logger.warn(`[C++ Format]: ⚠️ clang-format -i failed\n${fix.stderr}`);
-            return (0, types_1.warn)('clang-format failed to rewrite files');
+            // A WASM runtime error is the formatter giving up on a file, not a verdict
+            // about the code — and `-i` means whatever it managed before the crash is
+            // already written, so the tree is half-formatted. Saying which it was
+            // matters: "failed to rewrite files" sent people looking for a style
+            // problem that does not exist.
+            const crashed = /RuntimeError|memory access out of bounds|abort\(/.test(fix.stderr);
+            return (0, types_1.warn)(crashed
+                ? 'clang-format crashed on one of these files — some may already have been rewritten'
+                : `clang-format could not rewrite the files (exit ${fix.exitCode ?? 'killed'})`);
         }
         utils_1.logger.info(`[C++ Format]: ✅ Reformatted ${offending} C/C++ file(s)`);
         return (0, types_1.pass)(`reformatted ${offending} file(s)`);

package/dist/core/checks/languages/external-checks.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Every check that runs a linter or formatter we do not ship, as a table.
+ *
+ * The engine is in `external-runner.ts`; this file is only the data. What is
+ * genuinely per-language turns out to be four things — the binary, its
+ * arguments, the files it looks at, and how to read its output — and everything
+ * else was the same in all eleven of the modules this replaces.
+ *
+ * Keeping the entries together rather than one per file is the point: it is now
+ * possible to read what nine checks do at once, and a divergence between two of
+ * them is visible instead of two directories apart. Adding a tenth is an entry,
+ * not a file.
+ *
+ * The user-facing documentation stays per check, in
+ * `documentation/checks/languages/`, because that is organised around the reader's
+ * question ("how do I configure ktlint") rather than around ours.
+ */
+/**
+ * Lints changed Kotlin files with ktlint (style and formatting both, so it
+ * doubles as the Kotlin format signal). Uses the repo's own `.editorconfig`
+ * when present.
+ */
+export declare const kotlinLintCheck: import("../..").Check;
+/**
+ * Lints Swift with SwiftLint, which needs SourceKit and therefore a macOS
+ * runner. Runs over the directory rather than a file list — SwiftLint resolves
+ * its own `.swiftlint.yml` scope, and a file list would bypass the excludes a
+ * repo wrote there — so the resolved targets only decide whether it runs at all.
+ */
+export declare const swiftLintCheck: import("../..").Check;
+/**
+ * Lints changed Ruby files with RuboCop, which covers layout as well as style,
+ * so it doubles as the Ruby format signal. Uses the repo's own `.rubocop.yml`
+ * when present.
+ */
+export declare const rubyLintCheck: import("../..").Check;
+/**
+ * Lints changed shell scripts with ShellCheck. `-f gcc` gives one line per
+ * finding ending in an `[SC…]` code, which both a human and the count below can
+ * read directly.
+ *
+ * No language gate: shell is not something detection reports, and a `deploy.sh`
+ * in a Python repository is exactly the file this check exists for.
+ */
+export declare const shellcheckCheck: import("../..").Check;
+/**
+ * Vets changed Go code with `go vet ./...`, which needs the Go toolchain (the
+ * formatter next door no longer does — see `go-format.ts`). `go vet` operates
+ * per package, so it runs over the module rather than a file list; the delta
+ * only decides whether it runs.
+ */
+export declare const goLintCheck: import("../..").Check;
+/**
+ * Lints changed Rust with Clippy. It compiles the crate, so it runs over the
+ * crate rather than a file list; the delta only decides whether it runs.
+ */
+export declare const rustLintCheck: import("../..").Check;
+/**
+ * Formats changed Rust with `cargo fmt`, not a bare `rustfmt`: cargo reads the
+ * crate's edition from `Cargo.toml`, and rustfmt invoked directly does not —
+ * which silently formats 2015-edition code by 2024 rules.
+ */
+export declare const rustFormatCheck: import("../..").Check;
+/**
+ * Verifies C# formatting with `dotnet format`, which also runs the project's
+ * configured analyzers and style rules. It operates on the project or solution
+ * (and expects a prior `dotnet restore`), so it runs over the whole project; the
+ * delta only decides whether it runs.
+ */
+export declare const csharpFormatCheck: import("../..").Check;
+/**
+ * Formats changed PHP with PHP-CS-Fixer, using the repo's own
+ * `.php-cs-fixer.php` when present. `--using-cache=no` because the cache keys on
+ * absolute paths, and a CI checkout directory that changes between runs makes a
+ * stale cache report files as clean that were never examined.
+ */
+export declare const phpFormatCheck: import("../..").Check;