pr-checkmate 2.1.0 → 3.0.0

package/dist/core/checks/quality/config-validation.js

@@ -112,6 +112,35 @@ function validateFailOn(json) {
  * checks what the user actually wrote, not the merged defaults. `//`-comment keys
  * and `$schema` are ignored.
  */
+/**
+ * Report a `sourcePath` that points nowhere.
+ *
+ * Every scoped check restricts itself to these directories, so a path that does
+ * not exist silences them — and silences them as a PASS. Measured on a fixture
+ * with `"sourcePath": "src"` and the code in `app/`: a real conflict marker in
+ * `app/conflict.py` went unreported while Merge Conflict, a blocking check,
+ * printed ✅. Nothing else in the run mentioned that most of the repository had
+ * not been looked at.
+ *
+ * `init` defaults to `.` and recommends it, so this is not the common case — it
+ * is what happens when someone picks `src` at setup, or moves the code later, and
+ * that is precisely when nobody is looking for it.
+ */
+function validateSourcePath(json, cwd) {
+    const raw = json.sourcePath;
+    if (raw === undefined)
+        return [];
+    const paths = (Array.isArray(raw) ? raw : [raw]).filter((p) => typeof p === 'string' && p.trim().length > 0);
+    return paths
+        .filter(p => {
+        const normalised = p.replace(/^\.\/?/, '').replace(/\/+$/, '');
+        // `.` and `./` mean the whole repository and always exist.
+        if (normalised === '')
+            return false;
+        return !node_fs_1.default.existsSync(node_path_1.default.join(cwd, normalised));
+    })
+        .map(p => `sourcePath "${p}" does not exist — every scoped check silently reviews nothing, and reports a pass`);
+}
 exports.configValidationCheck = {
     name: 'Config Validation',
     phase: 'informational',
@@ -153,6 +182,7 @@ exports.configValidationCheck = {
             issues.push(...validateSeverity(json, checkNames));
         }
         issues.push(...validateFailOn(json));
+        issues.push(...validateSourcePath(json, ctx.cwd));
         if (issues.length === 0)
             return (0, types_1.pass)();
         // Advisory by default: a config problem is worth knowing about, but a repo

package/dist/core/checks/quality/duplicate-check.js

@@ -1,33 +1,65 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.duplicateCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
 const config_1 = require("../../../config");
 const constants_1 = require("../../../config/constants");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const findings_1 = require("../findings");
+/**
+ * The files to hand jscpd, per language.
+ *
+ * This map is why the check reads `ctx.languages` at all. It used to pass a fixed
+ * `*.ts,*.tsx,*.js,*.jsx` and gate itself on TypeScript/JavaScript, so a Python
+ * repository got `⏭️ Duplicate Code: no relevant files` — not because it had no
+ * duplication, but because nothing ever looked. The formats list in `constants.ts`
+ * named Python and C++ all along, which made the report's own claim untrue.
+ *
+ * Extensions mirror `detect-language.ts` so a language that decides the check runs
+ * is a language whose files it actually scans, with one deliberate addition: `.c`
+ * and `.h` under `cpp`, since a C project detects as `cpp` and the `c` format is
+ * one jscpd supports.
+ */
+const LANGUAGE_GLOBS = {
+    typescript: ['*.ts', '*.tsx'],
+    javascript: ['*.js', '*.jsx', '*.mjs', '*.cjs'],
+    python: ['*.py'],
+    cpp: ['*.cpp', '*.cc', '*.cxx', '*.c++', '*.hpp', '*.hh', '*.hxx', '*.c', '*.h'],
+    swift: ['*.swift'],
+    kotlin: ['*.kt', '*.kts', '*.java'],
+    go: ['*.go'],
+    rust: ['*.rs'],
+    csharp: ['*.cs'],
+    ruby: ['*.rb'],
+    php: ['*.php'],
+};
+/** The scan globs for one run: every detected language jscpd can tokenise. */
+function globsFor(languages) {
+    return [...new Set(languages.flatMap(lang => LANGUAGE_GLOBS[lang] ?? []))];
+}
 // Always excluded regardless of client config — scanning these never yields
 // meaningful production duplication. Config files (eslint/*.config.*) are data,
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
 // config), so their repetition is expected rather than a code smell.
 const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_1.CONFIG_FILE_PATTERNS];
-// jscpd v5 appends promotional/funding lines after its report. Strip them so
-// they never reach the client's terminal when running our package.
-const JSCPD_PROMO_MARKERS = [
-    'Auto-refactor with AI',
-    'github.com/kucherenko/jscpd',
-    'Gangsta Agents',
-    'gangsta.page',
-    'Support jscpd project',
-    'opencollective.com/jscpd',
-];
-function stripJscpdPromo(text) {
-    return text
-        .split('\n')
-        .filter(line => !JSCPD_PROMO_MARKERS.some(marker => line.includes(marker)))
-        .join('\n')
-        .trimEnd();
+/** `<path>:<start>-<end>`, repo-relative, for one end of a clone. */
+function locate(cwd, at) {
+    const name = at?.name ?? '';
+    const rel = name ? node_path_1.default.relative(cwd, name) || node_path_1.default.basename(name) : '<unknown file>';
+    return `${rel}:${at?.start ?? '?'}-${at?.end ?? '?'}`;
+}
+/** One reportable line per clone: both ends, and how big it is. */
+function describe(cwd, clone) {
+    const size = clone.lines === undefined ? '' : ` (${clone.lines} lines)`;
+    return `${locate(cwd, clone.firstFile)} ↔ ${locate(cwd, clone.secondFile)}${size}`;
 }
 exports.duplicateCheck = {
     name: 'Duplicate Code',
@@ -36,12 +68,12 @@ exports.duplicateCheck = {
     applies(ctx) {
         if (ctx.config.duplicate?.enabled === false)
             return false;
-        return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
+        return globsFor(ctx.languages).length > 0;
     },
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)(ctx.cwd));
         if (targetPaths === null)
             return (0, types_1.skip)('git unavailable');
         if (targetPaths.length === 0)
@@ -55,7 +87,16 @@ exports.duplicateCheck = {
         // defaulting to source-code formats so data files (yaml/json/markdown) are
         // not scanned. Clients can add them back explicitly.
         const formats = (ctx.config.duplicate?.formats ?? constants_1.DUPLICATE_CODE_FORMATS).join(',');
+        // The JSON reporter writes a file, so it needs somewhere to write it. Outside
+        // the repository deliberately: with no `--output`, jscpd creates `report/`
+        // in the client's working tree, and a check that leaves a directory behind is
+        // a check that shows up in the next commit.
+        const reportDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pr-checkmate-jscpd-'));
         try {
+            // `--silent` keeps jscpd's own console output away from the client entirely.
+            // That is what retired `stripJscpdPromo` — six string markers matching the
+            // funding lines jscpd v5 prints after its report, each good until the next
+            // release of somebody else's package.
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
                 '--min-lines',
@@ -63,27 +104,44 @@ exports.duplicateCheck = {
                 '--min-tokens',
                 String(minTokens),
                 '--reporters',
-                'console',
+                'json',
+                '--output',
+                reportDir,
+                '--absolute',
+                '--silent',
                 '--format',
                 formats,
                 '--ignore',
                 ignore,
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
-            const output = stripJscpdPromo([result.stdout, result.stderr].filter(Boolean).join('\n'));
-            const clonesMatch = output.match(/(\d+)\s+clone/i);
-            const cloneCount = clonesMatch ? parseInt(clonesMatch[1], 10) : 0;
-            if (cloneCount > 0) {
-                utils_1.logger.warn(`[Duplicate Code]: ⚠️ Found ${cloneCount} duplicate block(s)`);
-                if (output)
-                    utils_1.logger.warn(output);
-                return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
+            const reportPath = node_path_1.default.join(reportDir, 'jscpd-report.json');
+            if (!node_fs_1.default.existsSync(reportPath)) {
+                // No report and nothing to read it from: jscpd did not get as far as
+                // writing one. Its stderr is the only thing that can say why, and a skip
+                // is the honest outcome — an empty report would read as "no duplication".
+                utils_1.logger.warn(`[Duplicate Code]: ⚠️ jscpd wrote no report (exit ${result.exitCode ?? 'killed'})` +
+                    `${result.stderr ? `\n${result.stderr}` : ''}`);
+                return (0, types_1.skip)('jscpd produced no report');
             }
-            return (0, types_1.pass)();
+            const report = JSON.parse(node_fs_1.default.readFileSync(reportPath, 'utf-8'));
+            const clones = report.duplicates ?? [];
+            // jscpd's own count, not a regex over its prose. `output.match(/(\d+)\s+clone/i)`
+            // read the number out of an English sentence, so a reworded summary upstream
+            // would have reported zero duplication on a repository full of it — and
+            // reported it as a pass.
+            const cloneCount = report.statistics?.total?.clones ?? clones.length;
+            if (cloneCount === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logSample)('Duplicate Code', `${cloneCount} duplicate block(s):`, clones.map(clone => describe(ctx.cwd, clone)));
+            return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
         }
         catch (err) {
             utils_1.logger.warn(`[Duplicate Code]: ⚠️ Could not run duplicate check\n${err}`);
             return (0, types_1.skip)('jscpd unavailable');
         }
+        finally {
+            node_fs_1.default.rmSync(reportDir, { recursive: true, force: true });
+        }
     },
 };

package/dist/core/checks/quality/license-header.js

@@ -8,6 +8,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 /** Source extensions a license header is expected on. */
 const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|kt|java|go|rs|cs|rb|php|swift|c|cc|cpp|h|hpp)$/i;
@@ -49,10 +50,12 @@ exports.licenseHeaderCheck = {
                 ? ['diff', '--name-only', '--diff-filter=A', ctx.baseSha, ctx.headSha ?? 'HEAD']
                 : ['ls-files'];
             const { stdout } = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd });
-            added = stdout
-                .split('\n')
-                .filter(Boolean)
-                .filter(f => SOURCE_EXT.test(f));
+            // Its own git call rather than `resolveTargets`, and for one reason:
+            // `--diff-filter=A`. This check is about files a PR ADDS, and the shared
+            // resolver asks for ACMR — routing through it would start demanding a
+            // header on every modified file too, which is a different check. So the
+            // client's `excludePaths` is applied here explicitly instead (ticket 080).
+            added = (0, targets_1.excludeClientPaths)(stdout.split('\n').filter(Boolean), ctx.cwd).filter(f => SOURCE_EXT.test(f));
         }
         catch (err) {
             utils_1.logger.warn(`[License Header]: ⚠️ Could not analyze diff\n${err}`);

package/dist/core/checks/quality/markdown-lint.js

@@ -47,12 +47,7 @@ exports.markdownLintCheck = {
         const userRules = userConfig.rules ?? {};
         let tempConfigFile = null;
         let configArg;
-        if ((0, config_1.hasLocalConfig)([
-            '.markdownlint.json',
-            '.markdownlint.jsonc',
-            '.markdownlint.yaml',
-            '.markdownlint.yml',
-        ])) {
+        if ((0, config_1.hasLocalConfig)(['.markdownlint.json', '.markdownlint.jsonc', '.markdownlint.yaml', '.markdownlint.yml'], ctx.cwd)) {
             configArg = [];
         }
         else {

package/dist/core/checks/quality/spellcheck.js

@@ -188,19 +188,48 @@ function dropMissingLanguages(language, missing) {
     // to its own default, which is not necessarily what was configured here.
     return kept.length > 0 ? kept.join(',') : 'en';
 }
+/**
+ * Resolve a package id from the repository under review first, then from our own
+ * tree.
+ *
+ * The default `require.resolve` searches from THIS module, which is only the
+ * client's tree by accident. Installed as a dependency we sit in their
+ * `node_modules` and npm hoists `@cspell/dict-*` above us, so walking up finds
+ * it. Run through `npx` we sit in the npx cache and their `node_modules` is not
+ * on the path at all — so `npm i -D @cspell/dict-ru_ru`, which this file's own
+ * docstring promises is all it takes, did nothing and said nothing (ticket 081).
+ *
+ * Same policy as tool resolution for binaries: the client's copy first, ours as
+ * the fallback.
+ */
+function resolveFrom(cwd) {
+    return id => {
+        try {
+            return require.resolve(id, { paths: [cwd] });
+        }
+        catch {
+            return require.resolve(id);
+        }
+    };
+}
 function createTempCspellConfig(cwd) {
     const packageConfigPath = (0, config_1.getPackageConfigPath)('cspell.json');
     const packageConfigDir = node_path_1.default.dirname(packageConfigPath);
     const defaultConfig = JSON.parse(node_fs_1.default.readFileSync(packageConfigPath, 'utf-8'));
     const userConfig = loadUserCspellConfig(cwd);
     const merged = mergeCspellConfig(defaultConfig, userConfig);
-    const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir);
-    const available = availableDictionaries();
+    const resolve = resolveFrom(cwd);
+    const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir, resolve);
+    const available = availableDictionaries(resolve);
     for (const { pkg } of missing) {
         utils_1.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
     }
     if (available.absent.length > 0) {
-        utils_1.logger.debug(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
+        // `info`, not `debug`. A client who installed a dictionary and saw no change
+        // had nothing to read: the one line that would have explained it was behind a
+        // flag. Which dictionaries are in play decides which findings appear, so it
+        // belongs in the ordinary log (ticket 081).
+        utils_1.logger.info(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
             `Install any of them to spellcheck that language (\`npm i -D ${available.absent[0]}\`).`);
     }
     // A language the client asked for whose dictionary is absent is dropped rather
@@ -230,7 +259,7 @@ exports.spellcheckCheck = {
         return ctx.config.cspell?.enabled !== false && ctx.config.spellcheck?.enabled !== false;
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)());
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         // Committed build output and test reports are dropped here, in JS, against
@@ -246,7 +275,7 @@ exports.spellcheckCheck = {
         const files = targets.filter(f => !(0, utils_1.matchesAnyGlob)(f, config_1.IGNORE_PATTERNS));
         if (files.length === 0)
             return (0, types_1.pass)('no files to spellcheck');
-        const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json']);
+        const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json'], ctx.cwd);
         let tempConfigPath = null;
         const cspellBin = (0, utils_1.resolvePackageBin)('cspell', 'bin.mjs');
         // `--no-must-find-files`: cspell exits 1 when it checked nothing, which the

package/dist/core/checks/quality/symlinks.js

@@ -7,7 +7,6 @@ exports.symlinksCheck = void 0;
 exports.isBrokenSymlink = isBrokenSymlink;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
@@ -42,9 +41,12 @@ exports.symlinksCheck = {
         return ctx.config.symlinks?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], (0, config_1.getSourcePaths)());
-        if (files.length === 0)
-            return (0, types_1.skip)('no tracked files');
+        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+            wholeTree: true,
+            onEmpty: { skip: 'no tracked files' },
+        });
+        if (!Array.isArray(files))
+            return files;
         const ignore = ctx.config.symlinks?.ignore ?? [];
         const broken = [];
         for (const file of files) {

package/dist/core/checks/security/diff-security.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSecurityCheck = void 0;
 const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 const findings_1 = require("../findings");
 const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
@@ -298,6 +297,9 @@ exports.diffSecurityCheck = {
                 // to them, matching `duplicate.ignore` and `deadCode.ignoreFiles`. A client
                 // who wants their tests scanned says so by listing something else here.
                 ignorePaths: cfg.ignorePaths ?? config_1.DIFF_SECURITY_IGNORE_DEFAULTS,
+                // This check owns the cross-line heuristic, so it is the one that turns it
+                // on. `0` from the client switches it off.
+                dataflowWindow: cfg.dataflowWindow ?? findings_1.DEFAULT_DATAFLOW_WINDOW,
             };
             const extra = compileExtraPatterns(ctx);
             const disabled = cfg.disablePatterns ?? [];
@@ -306,33 +308,39 @@ exports.diffSecurityCheck = {
             };
             /**
              * Feed one language's sources through the patterns, from the diff when
-             * there is one and from the files themselves otherwise. Both paths reach
-             * `scanDiffPatterns` in the same shape, so the two modes cannot disagree
-             * about what counts as a finding.
+             * there is one and from the files themselves otherwise.
+             *
+             * Through {@link reviewLines}, like the four other checks that need both
+             * modes. This used to be its body copied inline, on the assumption that a
+             * closure was needed to carry `patterns` — it is not, that is what `onChunk`
+             * is for, and the copy meant `fullScanBehaviour` and the `null`/`[]`
+             * distinction lived in two places, one of them a blocking security check
+             * (ticket 079).
              */
-            const review = async (globs, patterns) => {
-                if (ctx.baseSha) {
-                    scanInto(await (0, findings_1.diffAddedLines)(ctx, globs), patterns);
-                    return;
-                }
-                if (ctx.config.run?.fullScanBehaviour === 'skip')
-                    return;
-                const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.']);
-                await (0, findings_1.scanTrackedFiles)(ctx, files, asDiff => scanInto(asDiff, patterns));
-            };
+            const review = (globs, patterns) => (0, findings_1.reviewLines)(ctx, globs, stdout => scanInto(stdout, patterns));
             // JS/TS patterns always run; language-specific sets scan their own globs
             // only when that language is present, so a Python repo gets Python rules.
             // Client `extraPatterns` run against every scanned language, since a
             // project rule is not tied to the built-in language split.
-            await review(JS_GLOBS, [...SECURITY_PATTERNS, ...extra]);
+            const sets = [[JS_GLOBS, [...SECURITY_PATTERNS, ...extra]]];
             if (ctx.languages.includes('python')) {
-                await review(['*.py'], [...PYTHON_SECURITY_PATTERNS, ...extra]);
+                sets.push([['*.py'], [...PYTHON_SECURITY_PATTERNS, ...extra]]);
             }
             if (ctx.languages.includes('go')) {
-                await review(['*.go'], [...GO_SECURITY_PATTERNS, ...extra]);
+                sets.push([['*.go'], [...GO_SECURITY_PATTERNS, ...extra]]);
             }
             if (ctx.languages.includes('kotlin')) {
-                await review(['*.kt', '*.kts', '*.java'], [...KOTLIN_SECURITY_PATTERNS, ...extra]);
+                sets.push([
+                    ['*.kt', '*.kts', '*.java'],
+                    [...KOTLIN_SECURITY_PATTERNS, ...extra],
+                ]);
+            }
+            for (const [globs, patterns] of sets) {
+                // One failed set fails the check. A partial answer is worse than none
+                // here: three of five language sets scanned, reported as a pass, reads
+                // as a clean repository (ticket 072).
+                if (!(await review(globs, patterns)))
+                    return (0, types_1.skip)('git unavailable');
             }
             return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: 'Diff Security',

package/dist/core/checks/security/dockerfile-security.js

@@ -30,7 +30,13 @@ const DOCKER_PATTERNS = [
         severity: 'warn',
     },
     {
-        pattern: /^\+(?!\+)\s*(?:ENV|ARG)\s+\w*(?:PASSWORD|SECRET|TOKEN|API_?KEY|ACCESS_KEY)\w*\s*[=\s]/i,
+        // The `_FILE`/`_PATH` exclusion is not a loophole, it is the thing this rule
+        // is trying to steer people towards: `ENV DB_PASSWORD_FILE=/run/secrets/db`
+        // names a location, holds no secret, and is how Docker and Kubernetes tell
+        // you to do it. Flagging the correct practice alongside the wrong one is how
+        // a rule gets switched off — and it teaches obscuring the variable name,
+        // which makes the next real secret harder to spot, not easier.
+        pattern: /^\+(?!\+)\s*(?:ENV|ARG)\s+\w*(?:PASSWORD|SECRET|TOKEN|API_?KEY|ACCESS_KEY)\w*(?<!_FILE)(?<!_PATH)(?<!_FILEPATH)\s*[=\s]/i,
         label: 'secret baked into ENV/ARG (use build secrets / runtime injection)',
         severity: 'warn',
     },

package/dist/core/checks/security/migration-safety.js

@@ -48,17 +48,45 @@ function isAddNotNullNoDefault(line) {
         /\bNOT\s+NULL\b/i.test(line) &&
         !/\bDEFAULT\b/i.test(line));
 }
+/**
+ * Drop the comment from an added migration line, keeping the leading `+` so the
+ * patterns stay anchored on it.
+ *
+ * This check does its own matching rather than going through `scanDiffPatterns`,
+ * and it inherited none of the comment handling — so a commented-out statement
+ * was reported as destructive. `-- DROP TABLE users;` does nothing, and calling
+ * it "irreversible data loss" is noise on the most alarming label the product
+ * prints. Found by ticket 062's corpus.
+ *
+ * Only the two markers that are unambiguous in the files this check looks at:
+ * `--` in SQL and `#` in Python/Ruby migrations. `--` is required to be preceded
+ * by whitespace or the line start, which keeps it away from an identifier like
+ * `a--b` and from most string contents; `stripInlineComment` handles `#` with the
+ * string awareness it already has.
+ */
+function withoutComment(line) {
+    // The diff marker is split off first: `+-- DROP TABLE` puts `--` immediately
+    // after the `+`, where a boundary rule looking for whitespace or line-start
+    // does not see it — which is exactly the shape a commented-out statement takes.
+    const marker = line.startsWith('+') ? '+' : '';
+    const body = (0, findings_1.stripInlineComment)(line.slice(marker.length), 'hash').replace(/(^|\s)--.*$/, '$1');
+    return marker + body;
+}
 /** Bucket dangerous added lines by risk label, honouring the opt-out directive. */
 function scan(stdout, findings) {
     for (const line of stdout.split('\n')) {
         if (line.includes('pr-checkmate-ignore'))
             continue;
+        // The sample keeps the ORIGINAL line: the reader needs to see what was
+        // written, comment and all, even though the match ran on the code.
+        const code = withoutComment(line);
+        const sample = () => line.slice(1).trim().substring(0, 120);
         for (const { pattern, label } of DDL_PATTERNS) {
-            if (pattern.test(line))
-                (findings[label] ?? (findings[label] = [])).push(line.slice(1).trim().substring(0, 120));
+            if (pattern.test(code))
+                (findings[label] ?? (findings[label] = [])).push(sample());
         }
-        if (isAddNotNullNoDefault(line)) {
-            (findings[NOT_NULL_NO_DEFAULT] ?? (findings[NOT_NULL_NO_DEFAULT] = [])).push(line.slice(1).trim().substring(0, 120));
+        if (isAddNotNullNoDefault(code)) {
+            (findings[NOT_NULL_NO_DEFAULT] ?? (findings[NOT_NULL_NO_DEFAULT] = [])).push(sample());
         }
     }
 }

package/dist/core/checks/security/security.d.ts

@@ -1,4 +1,60 @@
 import { Check } from '../../types';
+/**
+ * A HOME the scanner can actually write to.
+ *
+ * The bundled wrapper caches the gitleaks binary in `os.homedir()/.gitleaks-cache`
+ * and offers no way to move it — the path is hardcoded. So in any environment
+ * where HOME is not writable it crashes before scanning a single commit. That is
+ * not exotic: it is what the container does under `--user "$(id -u):$(id -g)"`,
+ * the invocation our own entrypoint and docs recommend, where HOME is `/`.
+ *
+ * Redirecting to the temp directory costs nothing that was available anyway — if
+ * HOME cannot be written to, there was no `~/.gitconfig` of ours to lose either.
+ */
+/**
+ * How many secrets the scan actually found.
+ *
+ * The row used to read `❌ Security Scan: potential secrets detected` whether the
+ * number was one or thirty-nine, and that is not a cosmetic gap. It is the reason
+ * a real regression nearly shipped: an allowlist entry removed six genuine
+ * `Generic API Key` findings from a client repository, 39 → 33, and the A/B sweep
+ * that compares report rows across 28 repositories saw two identical lines
+ * (ticket 085). A check that finds things has to say how many, or nothing can
+ * tell whether it started finding fewer.
+ *
+ * Read from gitleaks' JSON report rather than counted out of its console output —
+ * the same lesson as ticket 078, where the clone count was parsed from an English
+ * sentence and would have reported zero on a repository full of duplication.
+ *
+ * @returns The count, or `null` when the report could not be read — in which case
+ *   the caller keeps its old wording rather than claiming a number it does not have.
+ */
+export declare function countFindings(reportPath: string): number | null;
+/**
+ * How the outcome names what was found.
+ *
+ * Its own function so both halves are reachable without running the scanner. The
+ * corpus for this check deliberately does not: the wrapper downloads a gitleaks
+ * binary on first use, and a unit suite that reaches the network is the thing the
+ * `installer` seam in `ensure.ts` exists to avoid. What broke here was the wording
+ * — a row that read the same for one secret and for thirty-nine — and the wording
+ * is testable on its own.
+ *
+ * `null` keeps the old sentence rather than inventing a number: a report we could
+ * not read is not a reason to claim a count.
+ */
+export declare function secretsSummary(found: number | null): string;
+/**
+ * Whether the wrapper died instead of reporting, judged from its stderr.
+ *
+ * The wrapper is a Node script, and Node exits **1** on an unhandled exception —
+ * the same code gitleaks itself uses for "secrets found". Left undistinguished,
+ * a scanner that never ran is reported as `potential secrets detected`, pointing
+ * at a report file that was never written. A gate accusing a clean repository is
+ * the same class of failure as one that stays quiet about a real leak, and this
+ * is the only signal available to tell them apart.
+ */
+export declare function looksLikeCrash(stderr: string): boolean;
 /**
  * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on
  * every repo (Node, Python, C++, mobile). Secrets found → fail (blocking).