pr-checkmate 2.1.2 → 3.0.0

package/dist/utils/resolve-bin.js

@@ -3,51 +3,161 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerToolPaths = registerToolPaths;
+exports.clearToolPaths = clearToolPaths;
+exports.ownPackageRoot = ownPackageRoot;
+exports.packagePresent = packagePresent;
+exports.resolveTool = resolveTool;
 exports.resolvePackageBin = resolvePackageBin;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 /**
- * Resolves a binary path for a bundled package, bypassing exports map restrictions.
+ * Extra roots to search, registered once per run by the install layer.
  *
- * Strategy (tries each in order):
- * 1. Direct subpath — fast path for packages that explicitly export their bin
- * 2. Via package.json — for packages that export ./package.json but not the bin subpath (e.g. eslint)
- * 3. Walk up from main entry — for packages that export neither (e.g. cspell)
+ * Module state rather than a parameter threaded through fifteen call sites: a
+ * profile directory is a property of the *run*, not of any one check, and every
+ * check that resolves a binary would otherwise have to be handed a value it has
+ * no opinion about. `registerToolPaths` is called before the first check starts
+ * and never during one, so nothing observes it changing underneath.
+ */
+let profileRoots = [];
+/**
+ * Point tool resolution at the profile directories fetched for this run.
  *
- * @param pkgName - The package whose binary to resolve (e.g. `eslint`).
- * @param binRelPath - The bin path relative to the package root (e.g. `bin/eslint.js`).
- * @param options - Resolution options.
- * @param options.paths - Directories to resolve from (passed to `require.resolve`).
- *   Use `[process.cwd()]` to prefer the consumer project's copy of the package.
+ * Called by the install layer once the cache is known. Passing an empty list —
+ * or never calling it at all — leaves resolution exactly as it was before
+ * profiles existed, which is what keeps a run that needs no fetching identical
+ * to a run from before there was anything to fetch.
  */
-function resolvePackageBin(pkgName, binRelPath, options) {
-    const resolveOpts = options?.paths ? { paths: options.paths } : undefined;
-    // 1. Direct subpath
+function registerToolPaths(dirs) {
+    profileRoots = [...dirs];
+}
+/** Drop every registered profile root. For tests, and for a second run in-process. */
+function clearToolPaths() {
+    profileRoots = [];
+}
+/** The root of the installed pr-checkmate package — where our own tooling lives. */
+function ownPackageRoot() {
+    return node_path_1.default.resolve(__dirname, '../..');
+}
+/**
+ * Whether a package is physically present in our own dependency tree.
+ *
+ * Checked by walking `node_modules` upwards rather than by `require.resolve`,
+ * because a package that restricts its `exports` map resolves for neither its
+ * main entry nor its `package.json` while being perfectly well installed —
+ * `cspell` is one. The question here is only "is it there", and the directory
+ * answers that without an opinion about what it chooses to export.
+ *
+ * Walking up matters as much as the check itself: installed as a dependency, our
+ * own packages are hoisted to the client's `node_modules`, one level above ours.
+ */
+function packagePresent(pkgName, from = ownPackageRoot()) {
+    let dir = from;
+    while (dir !== node_path_1.default.dirname(dir)) {
+        if (node_fs_1.default.existsSync(node_path_1.default.join(dir, 'node_modules', pkgName, 'package.json')))
+            return true;
+        dir = node_path_1.default.dirname(dir);
+    }
+    return false;
+}
+/** One resolution attempt against a single set of search paths. */
+function tryResolve(pkgName, binRelPath, paths) {
+    const resolveOpts = paths ? { paths } : undefined;
+    // 1. Direct subpath — the fast path for packages that export their bin.
     try {
         return require.resolve(`${pkgName}/${binRelPath}`, resolveOpts);
     }
     catch { }
-    // 2. Via package.json
+    // 2. Via package.json — for packages that export `./package.json` but not the
+    //    bin subpath (eslint).
     try {
         const pkgJsonPath = require.resolve(`${pkgName}/package.json`, resolveOpts);
         return node_path_1.default.join(node_path_1.default.dirname(pkgJsonPath), binRelPath);
     }
     catch { }
-    // 3. Walk up from main entry to find package root by matching package name
-    const main = require.resolve(pkgName, resolveOpts);
-    let dir = node_path_1.default.dirname(main);
-    while (dir !== node_path_1.default.dirname(dir)) {
-        const pkgJsonPath = node_path_1.default.join(dir, 'package.json');
-        if (node_fs_1.default.existsSync(pkgJsonPath)) {
-            try {
-                const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
-                if (pkg.name === pkgName) {
-                    return node_path_1.default.join(dir, binRelPath);
+    // 3. Walk up from the main entry, matching the package name — for packages
+    //    that export neither (cspell).
+    try {
+        let dir = node_path_1.default.dirname(require.resolve(pkgName, resolveOpts));
+        while (dir !== node_path_1.default.dirname(dir)) {
+            const pkgJsonPath = node_path_1.default.join(dir, 'package.json');
+            if (node_fs_1.default.existsSync(pkgJsonPath)) {
+                try {
+                    const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
+                    if (pkg.name === pkgName)
+                        return node_path_1.default.join(dir, binRelPath);
                 }
+                catch { }
             }
-            catch { }
+            dir = node_path_1.default.dirname(dir);
         }
-        dir = node_path_1.default.dirname(dir);
     }
+    catch { }
+    return null;
+}
+/**
+ * The roots to try, in order, and what finding a tool in each one means.
+ *
+ * The order is the policy, and it is deliberate:
+ *
+ * 1. **The client's own copy**, when a caller asked for it. A repository pinned
+ *    to ESLint 8 with a legacy `.eslintrc` must keep working, and only its copy
+ *    can do that.
+ * 2. **A fetched profile**, for tooling that does not ship inside the package.
+ * 3. **Our bundle** — module-relative, exactly as resolution worked before
+ *    profiles existed.
+ *
+ * Branch 3 is passed `undefined` rather than our package root on purpose: that is
+ * literally the previous behaviour, so a run with nothing registered resolves
+ * every tool along the identical path it always did.
+ */
+function candidates(optPaths) {
+    const list = [];
+    if (optPaths && optPaths.length > 0)
+        list.push({ paths: optPaths, source: 'client' });
+    for (const root of profileRoots)
+        list.push({ paths: [root], source: 'profile' });
+    list.push({ source: 'bundled' });
+    return list;
+}
+/**
+ * Resolve a tool's binary and say which copy answered.
+ *
+ * Use this over {@link resolvePackageBin} when the answer is worth logging — the
+ * source is the difference between "the client's ESLint 8 ran" and "ours did",
+ * and that is the first thing anyone asks when a lint result looks wrong.
+ *
+ * @param pkgName Package whose binary to resolve (e.g. `eslint`).
+ * @param binRelPath Bin path relative to the package root (e.g. `bin/eslint.js`).
+ * @param options Resolution options.
+ * @param options.paths Roots to prefer ahead of everything else. Use
+ *   `[process.cwd()]` to prefer the consumer project's copy.
+ */
+function resolveTool(pkgName, binRelPath, options) {
+    for (const candidate of candidates(options?.paths)) {
+        const bin = tryResolve(pkgName, binRelPath, candidate.paths);
+        if (bin)
+            return { bin, source: candidate.source, root: candidate.paths?.[0] };
+    }
+    return null;
+}
+/**
+ * Resolves a binary path for a bundled package, bypassing exports map restrictions.
+ *
+ * Throws when no copy can be found anywhere, which is the honest outcome: a check
+ * that cannot find its tool has nothing to report, and the install layer turns
+ * that into a skip with a reason rather than letting it surface as a stack trace.
+ *
+ * @param pkgName - The package whose binary to resolve (e.g. `eslint`).
+ * @param binRelPath - The bin path relative to the package root (e.g. `bin/eslint.js`).
+ * @param options - Resolution options.
+ * @param options.paths - Directories to resolve from, preferred over everything
+ *   else. Use `[process.cwd()]` to prefer the consumer project's copy.
+ */
+function resolvePackageBin(pkgName, binRelPath, options) {
+    const resolved = resolveTool(pkgName, binRelPath, options);
+    if (resolved)
+        return resolved.bin;
     throw new Error(`Cannot resolve binary "${binRelPath}" for package "${pkgName}"`);
 }

package/gitleaks.toml

@@ -3,6 +3,20 @@ title = "pr-checkmate gitleaks config"
 [extend]
 useDefault = true
 
+# THIS FILE SHIPS, AND IT IS APPLIED TO EVERY CLIENT WITHOUT A GITLEAKS CONFIG OF
+# THEIR OWN. Read `src/core/checks/security/security.ts`: `--config` points here
+# whenever `hasLocalConfig` finds nothing in the repository being scanned.
+#
+# So an entry added here to quieten OUR OWN corpus silences it for everybody. That
+# was measured, not imagined: adding `tests/` to the paths below removed six real
+# `Generic API Key` findings from a client repository — under
+# `packages/commons/tests/`, `packages/node/tests/`, and three more — in a check
+# that BLOCKS. Our own noise is never a reason to widen this list; use
+# `.gitleaksignore` in this repository instead, which does not ship.
+#
+# `__tests__` predates that and is left alone: it is a convention for a directory
+# of test files specifically, not a whole path segment named `test`.
+
 [allowlist]
 description = "pr-checkmate global allowlist"
 paths = [

package/install-manifests/go/package-lock.json

@@ -0,0 +1,24 @@
+{
+  "name": "pr-checkmate-profile-go",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pr-checkmate-profile-go",
+      "version": "1.0.0",
+      "dependencies": {
+        "@wasm-fmt/gofmt": "0.7.3"
+      }
+    },
+    "node_modules/@wasm-fmt/gofmt": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/@wasm-fmt/gofmt/-/gofmt-0.7.3.tgz",
+      "integrity": "sha512-nzVTwMxHDOYrHonT7DzjqicbaTYOYPNYeXKPJnDrVUbJjx67Sg/LS1uzlOTWKToGMF8Y8l0u7G5/5Q3/8nHMMA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.17.0"
+      }
+    }
+  }
+}

package/install-manifests/go/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pr-checkmate-profile-go",
+  "version": "1.0.0",
+  "dependencies": {
+    "@wasm-fmt/gofmt": "0.7.3"
+  },
+  "private": true
+}

package/install-manifests/pytypes/package-lock.json

@@ -0,0 +1,45 @@
+{
+  "name": "pr-checkmate-profile-pytypes",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pr-checkmate-profile-pytypes",
+      "version": "1.0.0",
+      "dependencies": {
+        "pyright": "1.1.413"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/pyright": {
+      "version": "1.1.413",
+      "resolved": "https://registry.npmjs.org/pyright/-/pyright-1.1.413.tgz",
+      "integrity": "sha512-1lpxKrh0DHHpfAQOfciZo2ojua2jase3wwO9at8kldc+F/p1PBscxA5CQ3G1qg5lMOMhXo6ZaiMLMXEAqADIAg==",
+      "license": "MIT",
+      "bin": {
+        "pyright": "index.js",
+        "pyright-langserver": "langserver.index.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    }
+  }
+}

package/install-manifests/pytypes/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pr-checkmate-profile-pytypes",
+  "version": "1.0.0",
+  "dependencies": {
+    "pyright": "1.1.413"
+  },
+  "private": true
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "2.1.2",
+    "version": "3.0.0",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -52,7 +52,7 @@
         "spellcheck": "cspell '**/*.{ts,tsx,js,jsx,md,json}' --no-progress",
         "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
-        "test": "node --require ts-node/register --test --test-timeout=60000 --test-concurrency=1 \"tests/**/*.test.ts\"",
+        "test": "node --require ts-node/register --test --test-timeout=60000 \"tests/**/*.test.ts\"",
         "test:ci": "bash scripts/test-per-file.sh",
         "verify:tarball": "bash scripts/verify-tarball.sh",
         "security-scan": "npx pr-checkmate security",
@@ -82,6 +82,7 @@
         "@typescript-eslint/eslint-plugin": "^8.62.1",
         "@typescript-eslint/parser": "^8.62.1",
         "@wasm-fmt/clang-format": "^22.1.8",
+        "@wasm-fmt/gofmt": "^0.7.3",
         "cspell": "^10.0.1",
         "dpdm": "^4.2.0",
         "eslint": "^10.6.0",
@@ -106,6 +107,7 @@
     "devDependencies": {
         "conventional-commits-filter": "^5.0.0",
         "conventional-commits-parser": "^6.4.0",
+        "pyright": "^1.1.413",
         "standard-version": "^9.5.0",
         "typedoc": "^0.28.20"
     },

package/pr-checkmate.schema.json

@@ -727,7 +727,7 @@
           "default": 1
         },
         "reuseLocal": {
-          "description": "Reuse a tool already in the client's node_modules: \"compatible\" (default), \"always\", or \"off\".",
+          "description": "Reuse a tool already present in the repository's node_modules instead of our copy. \"compatible\" (default) reuses when the major matches ours, or when the tool reads the repository's own config (a legacy .eslintrc can only be read by the ESLint that wrote it, and a tsconfig by its own compiler). \"always\" reuses across a major gap at your own risk. \"off\" always uses our pinned copy, for reproducibility.",
           "type": "string",
           "enum": ["compatible", "always", "off"],
           "default": "compatible"
@@ -761,7 +761,7 @@
           "default": "~/.cache/pr-checkmate"
         },
         "prewarm": {
-          "description": "Warm the cache in postinstall. false leaves everything to the lazy path.",
+          "description": "NOT YET IMPLEMENTED — accepted and ignored. Warming the cache needs a postinstall hook, and there is nothing to warm while every profile's tooling ships inside the package; the hook lands with the dependency extraction (ticket 064, release 2). Documented as inert rather than quietly doing nothing.",
           "type": "boolean",
           "default": true
         },
@@ -1174,6 +1174,12 @@
               }
             }
           }
+        },
+        "dataflowWindow": {
+          "type": "integer",
+          "minimum": 0,
+          "default": 10,
+          "description": "Added lines a value stays tainted for, connecting an interpolated string assigned on one line to a query on a later line. 0 disables the cross-line heuristic. Advisory only — it has no scopes and no reassignment tracking, so it never blocks a run."
         }
       }
     },