pr-checkmate 2.1.2 → 3.0.1

package/dist/core/install/prepare.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileSatisfiedLocally = profileSatisfiedLocally;
+exports.prepareTooling = prepareTooling;
+exports.noTooling = noTooling;
+const logger_1 = require("../../utils/logger");
+const resolve_bin_1 = require("../../utils/resolve-bin");
+const ensure_1 = require("./ensure");
+const profiles_1 = require("./profiles");
+/**
+ * Whether a profile needs fetching at all, or already ships inside the package.
+ *
+ * This is the hinge the whole adaptive-install rollout turns on. Nearly every
+ * profile's packages sit in our `dependencies`, so it answers `true`, nothing is
+ * fetched, and a run is byte-for-byte the run it was before any of this existed.
+ * `pytypes` is the exception that already proves the other half works: `pyright`
+ * is a devDependency, so it reaches no client and is fetched on demand. When a
+ * package is moved out of `dependencies` it stops being present, its profile
+ * starts answering `false`, and the fetch turns itself on — no flag, no second
+ * code path, nothing to remember to flip.
+ *
+ * Which is what makes releases 2 and 3 of ticket 064 an edit to `package.json`
+ * rather than another change to this logic.
+ */
+function profileSatisfiedLocally(profile) {
+    return profile.packages.every(pkg => (0, resolve_bin_1.packagePresent)(pkg));
+}
+/** Profiles blocked outright by `install.deny`, with a line saying so. */
+function denied(profile, deny) {
+    const blocked = profile.packages.filter(pkg => deny.has(pkg));
+    if (blocked.length === 0)
+        return null;
+    return `install.deny lists ${blocked.join(', ')}`;
+}
+/**
+ * Make sure the tooling this run needs is present, and say what is missing.
+ *
+ * Runs once, before the first check, and answers two questions the run cannot
+ * proceed honestly without: which directories tool resolution should search, and
+ * which checks have no tool to run. The second is the one ticket 057 is about —
+ * a check whose tooling never arrived must appear in the report saying so, not
+ * vanish from it.
+ *
+ * Only profiles backing checks that are actually selected are considered, so
+ * `severity: { "Spellcheck": "off" }` stops costing a download rather than only a
+ * row in the report (lever B of ticket 064).
+ */
+async function prepareTooling(opts) {
+    // Every run starts from no registered roots. The SDK can call `runChecks` more
+    // than once in one process, and a directory registered by a previous run — for
+    // a different repository, with a different profile set — must not still be on
+    // the search path for this one.
+    (0, resolve_bin_1.clearToolPaths)();
+    const install = opts.config.install ?? {};
+    const strategy = process.env.PR_CHECKMATE_INSTALL_STRATEGY ?? install.strategy ?? 'adaptive';
+    const onMissing = install.onMissingTool ?? 'auto';
+    const deny = new Set(install.deny ?? []);
+    // Which profiles this repository needs: languages by file count, universal
+    // profiles by whether their check survived config. `install.profiles` and
+    // `excludeProfiles` have already had their say inside `planProfiles`.
+    const required = new Set((0, profiles_1.planProfiles)(opts.usage, opts.config)
+        .filter(decision => decision.required)
+        .map(decision => decision.profile));
+    // A profile nobody in this run would use is not worth a thought, let alone a
+    // download. `eager` opts out of that reasoning by definition: it exists so a
+    // container build or an air-gapped mirror can hold everything up front.
+    const chosen = opts.selected.length > 0 ? new Set(opts.selected) : null;
+    const wanted = (opts.profiles ?? profiles_1.PROFILES).filter(profile => {
+        if (strategy === 'eager')
+            return true;
+        if (!required.has(profile.name))
+            return false;
+        return !chosen || profile.checks.some(check => chosen.has(check));
+    });
+    const unavailable = new Map();
+    const dirs = [];
+    const miss = (profile, reason) => {
+        for (const check of profile.checks)
+            unavailable.set(check, reason);
+    };
+    const toFetch = [];
+    for (const profile of wanted) {
+        // Bundled tooling is the answer to "where is it" for most profiles, and
+        // asking first is what keeps this whole path free of network calls.
+        if (profileSatisfiedLocally(profile))
+            continue;
+        const block = denied(profile, deny);
+        if (block) {
+            miss(profile, block);
+            continue;
+        }
+        // No early exit for `install.strategy: "manual"`. It means "never fetch",
+        // and `ensureTooling` enforces that — but only after checking the cache, so
+        // pre-warmed tooling is still used. Returning here instead meant `manual`
+        // also refused tooling that was already downloaded.
+        if (onMissing === 'skip') {
+            miss(profile, 'install.onMissingTool is "skip"');
+            continue;
+        }
+        toFetch.push(profile);
+    }
+    // One call, one directory, one lock — for the whole run rather than per profile.
+    // Profiles overlap heavily, and a tree each made the client download the shared
+    // half once per profile that named it (ticket 087).
+    //
+    // Reached only when something actually needs fetching, which is also what keeps
+    // the cache directory untouched otherwise: resolving it is not a read — it
+    // creates the directory and warns when the configured path is unwritable, and a
+    // container with a read-only home would print that on every single run.
+    if (toFetch.length > 0) {
+        const result = await (0, ensure_1.ensureTooling)(toFetch.map(profile => profile.name), {
+            cwd: opts.cwd,
+            version: opts.version,
+            install,
+            ...(opts.installer ? { installer: opts.installer } : {}),
+        });
+        if (result.status === 'failed' || result.status === 'skipped') {
+            for (const profile of toFetch)
+                miss(profile, result.reason);
+        }
+        else if (result.dir) {
+            dirs.push(result.dir);
+        }
+    }
+    if (unavailable.size > 0) {
+        // Always logged, never behind --debug. A check that did not run is the
+        // failure mode this whole layer exists to make loud.
+        const names = [...new Set(unavailable.keys())].join(', ');
+        logger_1.logger.warn(`[install]: ⚠️ tooling unavailable — these checks cannot run: ${names}`);
+        if (onMissing === 'error') {
+            logger_1.logger.error('[install]: ❌ install.onMissingTool is "error" — the affected checks fail');
+        }
+        else {
+            logger_1.logger.info('[install]:    Pre-warm the cache with: npx pr-checkmate install --all');
+        }
+    }
+    (0, resolve_bin_1.registerToolPaths)(dirs);
+    return { unavailable, dirs, fatal: onMissing === 'error' && unavailable.size > 0 };
+}
+/**
+ * The plan for a run where preparation did not happen — nothing missing, nothing
+ * registered. Built fresh each time rather than shared: a caller holding a plan
+ * must not be able to see another run's.
+ */
+function noTooling() {
+    return { unavailable: new Map(), dirs: [], fatal: false };
+}

package/dist/core/install/profiles.d.ts

@@ -12,7 +12,7 @@ import type { Language, LanguageUsage } from '../../utils/detect-language';
  * honest report: when a profile is missing, exactly those checks skip, with the
  * reason, instead of quietly disappearing (the mistake of ticket 057).
  */
-interface Profile {
+export interface Profile {
     name: ProfileName;
     /** Top-level packages installed for this profile. */
     packages: string[];
@@ -23,8 +23,23 @@ interface Profile {
      * enabled checks rather than by what the repository is written in.
      */
     languages?: Language[];
+    /**
+     * An extra condition on the client's config, for a language profile whose
+     * checks can be switched off by a key of their own.
+     *
+     * `severity: { "X": "off" }` is already honoured for every profile, but it is
+     * not the only off switch: `python.typecheck: false` and `go.enabled: false`
+     * are the ones a client actually writes, and a language profile decided on
+     * file counts alone downloads the tooling regardless. For `pytypes` that is
+     * 19 MB fetched to run nothing.
+     *
+     * Deliberately a predicate over the config rather than a list of keys: the
+     * condition it mirrors lives in the check's own `applies`, and expressing it
+     * the same way is what makes the two readable side by side.
+     */
+    enabledBy?(config: PRCheckMateConfig): boolean;
 }
-export type ProfileName = 'core' | 'js' | 'python' | 'cpp' | 'spellcheck' | 'markdown' | 'commitlint' | 'duplicate';
+export type ProfileName = 'core' | 'js' | 'python' | 'pytypes' | 'cpp' | 'go' | 'spellcheck' | 'markdown' | 'commitlint' | 'duplicate';
 /**
  * The catalogue.
  *
@@ -61,4 +76,3 @@ export interface ProfileDecision {
  * @returns One decision per profile, in catalogue order.
  */
 export declare function planProfiles(usage: LanguageUsage[], config: PRCheckMateConfig): ProfileDecision[];
-export {};

package/dist/core/install/profiles.js

@@ -54,12 +54,33 @@ exports.PROFILES = [
         checks: ['Ruff Lint', 'Ruff Format'],
         languages: ['python'],
     },
+    {
+        // Separate from `python` because it is 19 MB against ruff's 12, and because
+        // the two answer different questions: plenty of repositories want the linter
+        // and have their own opinion about type checking. Bundling them would make
+        // `python.typecheck: false` cost the download anyway, which is the feature
+        // defeating itself.
+        name: 'pytypes',
+        packages: ['pyright'],
+        checks: ['Python Types'],
+        languages: ['python'],
+        enabledBy: config => config.python?.typecheck !== false && config.python?.enabled !== false,
+    },
     {
         name: 'cpp',
         packages: ['@wasm-fmt/clang-format'],
         checks: ['C++ Format'],
         languages: ['cpp'],
     },
+    {
+        // Go Format only. `go vet` needs the toolchain itself, which is not ours to
+        // ship, so it stays a runner dependency and is deliberately absent here.
+        name: 'go',
+        packages: ['@wasm-fmt/gofmt'],
+        checks: ['Go Format'],
+        languages: ['go'],
+        enabledBy: config => config.go?.enabled !== false,
+    },
     {
         // The four below are not languages. They are single checks with heavy
         // tooling behind them, which is exactly why they are separate: switching
@@ -145,6 +166,12 @@ function decide(profile, usage, config, minFiles) {
     if (profile.name === 'core')
         return { required: true, reason: 'always installed' };
     if (profile.languages) {
+        // Asked before the file counts, because it is the cheaper and the more
+        // definite answer: a client who wrote `python.typecheck: false` has settled
+        // the question, and counting `.py` files can only override them.
+        if (profile.enabledBy && !profile.enabledBy(config)) {
+            return { required: false, reason: `${profile.checks.join(', ')} switched off` };
+        }
         const found = profile.languages
             .map(lang => usage.find(u => u.lang === lang))
             .filter((u) => Boolean(u) && u.files >= minFiles);

package/dist/core/install/reuse.d.ts

@@ -0,0 +1,41 @@
+import type { CheckContext } from '../types';
+/** One reuse decision, with the sentence that explains it. */
+interface ReuseDecision {
+    /** Search roots to prefer, or `undefined` to use our own copy. */
+    paths?: string[];
+    reason: string;
+}
+interface ReuseOptions {
+    /**
+     * The tool will read the client's OWN configuration file.
+     *
+     * When it will, the version check is the wrong question and must not be asked:
+     * a repository with ESLint 8 and a legacy `.eslintrc` can only be linted by
+     * ESLint 8, because ESLint 10 does not read eslintrc — and falling back to ours
+     * on the strength of a major mismatch would break precisely the case the reuse
+     * was there to serve. TypeScript is the same shape permanently: the check only
+     * applies when the repository has a `tsconfig.json`, so their compiler is
+     * always the one their config was written for.
+     *
+     * The version check exists for the opposite case — the client's old tool being
+     * handed configuration WE generated.
+     */
+    clientOwnsConfig?: boolean;
+}
+/**
+ * Decide whether this run should prefer the client's copy of `pkgName`.
+ *
+ * `compatible` (the default) reuses when the client's major matches ours, or when
+ * the client's own configuration is what the tool will read. A mismatch is not an
+ * error — we have our own copy — so it downgrades to ours with a line saying why.
+ */
+export declare function reuseDecision(pkgName: string, ctx: CheckContext, opts?: ReuseOptions): ReuseDecision;
+/**
+ * The search roots a check should prefer for `pkgName`, logging the reason once.
+ *
+ * The reason is logged rather than returned to each caller because it answers the
+ * question every confusing lint result starts with — "whose ESLint ran" — and no
+ * check should have to remember to say so.
+ */
+export declare function clientToolPaths(pkgName: string, ctx: CheckContext, opts?: ReuseOptions): string[] | undefined;
+export {};

package/dist/core/install/reuse.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reuseDecision = reuseDecision;
+exports.clientToolPaths = clientToolPaths;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const logger_1 = require("../../utils/logger");
+const resolve_bin_1 = require("../../utils/resolve-bin");
+/**
+ * The major version we declare for a tool, from our own manifest.
+ *
+ * Read from `dependencies` rather than from the installed tree: what matters is
+ * the version our configuration was written against, and a hoisted install can
+ * resolve to something else entirely.
+ */
+function ownMajor(pkgName) {
+    try {
+        const manifest = node_path_1.default.join((0, resolve_bin_1.ownPackageRoot)(), 'package.json');
+        const deps = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8')).dependencies;
+        const range = deps?.[pkgName];
+        if (!range)
+            return null;
+        // `^10.6.0`, `>=3.0.0`, `~5.1` — the leading number is the major in every
+        // form we declare. Deliberately not a semver parser: this package ships zero
+        // runtime dependencies on purpose, and a major comparison is the only
+        // question being asked.
+        const major = /(\d+)/.exec(range)?.[1];
+        return major ? Number(major) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The major version of a package as the client actually has it installed. */
+function installedMajor(pkgName, from) {
+    let dir = from;
+    while (dir !== node_path_1.default.dirname(dir)) {
+        const manifest = node_path_1.default.join(dir, 'node_modules', pkgName, 'package.json');
+        try {
+            if (node_fs_1.default.existsSync(manifest)) {
+                const version = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8'))
+                    .version;
+                const major = version ? /(\d+)/.exec(version)?.[1] : undefined;
+                return major ? Number(major) : null;
+            }
+        }
+        catch {
+            return null;
+        }
+        dir = node_path_1.default.dirname(dir);
+    }
+    return null;
+}
+/**
+ * Decide whether this run should prefer the client's copy of `pkgName`.
+ *
+ * `compatible` (the default) reuses when the client's major matches ours, or when
+ * the client's own configuration is what the tool will read. A mismatch is not an
+ * error — we have our own copy — so it downgrades to ours with a line saying why.
+ */
+function reuseDecision(pkgName, ctx, opts = {}) {
+    const policy = ctx.config.install?.reuseLocal ?? 'compatible';
+    if (policy === 'off') {
+        return { reason: 'install.reuseLocal is "off" — using our own copy for reproducibility' };
+    }
+    const clientMajor = installedMajor(pkgName, ctx.cwd);
+    if (clientMajor === null) {
+        return { reason: `${pkgName} is not installed in the repository — using our own copy` };
+    }
+    if (policy === 'always') {
+        return {
+            paths: [ctx.cwd],
+            reason: `install.reuseLocal is "always" — using ${pkgName}@${clientMajor} from the repository`,
+        };
+    }
+    if (opts.clientOwnsConfig) {
+        return {
+            paths: [ctx.cwd],
+            reason: `using ${pkgName}@${clientMajor} from the repository — it reads the repository's own config`,
+        };
+    }
+    const ourMajor = ownMajor(pkgName);
+    if (ourMajor === null || clientMajor === ourMajor) {
+        return {
+            paths: [ctx.cwd],
+            reason: `using ${pkgName}@${clientMajor} from the repository (matches ours)`,
+        };
+    }
+    return {
+        reason: `the repository has ${pkgName}@${clientMajor} and our config is written for @${ourMajor} — using our own copy`,
+    };
+}
+/**
+ * The search roots a check should prefer for `pkgName`, logging the reason once.
+ *
+ * The reason is logged rather than returned to each caller because it answers the
+ * question every confusing lint result starts with — "whose ESLint ran" — and no
+ * check should have to remember to say so.
+ */
+function clientToolPaths(pkgName, ctx, opts = {}) {
+    const decision = reuseDecision(pkgName, ctx, opts);
+    logger_1.logger.debug(`[reuseLocal]: ${decision.reason}`);
+    return decision.paths;
+}

package/dist/core/registry.js

@@ -18,21 +18,13 @@ const merge_conflict_1 = require("./checks/git/merge-conflict");
 const missing_tests_1 = require("./checks/git/missing-tests");
 const todo_fixme_1 = require("./checks/git/todo-fixme");
 const cpp_format_1 = require("./checks/languages/cpp-format");
-const csharp_format_1 = require("./checks/languages/csharp-format");
+const external_checks_1 = require("./checks/languages/external-checks");
 const go_format_1 = require("./checks/languages/go-format");
-const go_lint_1 = require("./checks/languages/go-lint");
-const kotlin_lint_1 = require("./checks/languages/kotlin-lint");
 const lint_1 = require("./checks/languages/lint");
-const php_format_1 = require("./checks/languages/php-format");
 const prettier_1 = require("./checks/languages/prettier");
 const python_format_1 = require("./checks/languages/python-format");
 const python_lint_1 = require("./checks/languages/python-lint");
 const python_typecheck_1 = require("./checks/languages/python-typecheck");
-const ruby_lint_1 = require("./checks/languages/ruby-lint");
-const rust_format_1 = require("./checks/languages/rust-format");
-const rust_lint_1 = require("./checks/languages/rust-lint");
-const shellcheck_1 = require("./checks/languages/shellcheck");
-const swift_lint_1 = require("./checks/languages/swift-lint");
 const typecheck_1 = require("./checks/languages/typecheck");
 const commitlint_1 = require("./checks/pr/commitlint");
 const pr_body_1 = require("./checks/pr/pr-body");
@@ -45,6 +37,7 @@ const dead_code_1 = require("./checks/quality/dead-code");
 const duplicate_check_1 = require("./checks/quality/duplicate-check");
 const license_header_1 = require("./checks/quality/license-header");
 const markdown_lint_1 = require("./checks/quality/markdown-lint");
+const package_size_1 = require("./checks/quality/package-size");
 const spellcheck_1 = require("./checks/quality/spellcheck");
 const symlinks_1 = require("./checks/quality/symlinks");
 const yaml_lint_1 = require("./checks/quality/yaml-lint");
@@ -98,21 +91,22 @@ exports.REGISTRY = [
     spellcheck_1.spellcheckCheck,
     yaml_lint_1.yamlLintCheck,
     symlinks_1.symlinksCheck,
+    package_size_1.packageSizeCheck,
     python_lint_1.pythonLintCheck,
     python_typecheck_1.pythonTypecheckCheck,
     dead_code_1.deadCodeCheck,
-    swift_lint_1.swiftLintCheck,
-    kotlin_lint_1.kotlinLintCheck,
-    go_lint_1.goLintCheck,
-    rust_lint_1.rustLintCheck,
-    ruby_lint_1.rubyLintCheck,
-    shellcheck_1.shellcheckCheck,
+    external_checks_1.swiftLintCheck,
+    external_checks_1.kotlinLintCheck,
+    external_checks_1.goLintCheck,
+    external_checks_1.rustLintCheck,
+    external_checks_1.rubyLintCheck,
+    external_checks_1.shellcheckCheck,
     // format
     prettier_1.prettierCheck,
     cpp_format_1.cppFormatCheck,
     python_format_1.pythonFormatCheck,
     go_format_1.goFormatCheck,
-    rust_format_1.rustFormatCheck,
-    csharp_format_1.csharpFormatCheck,
-    php_format_1.phpFormatCheck,
+    external_checks_1.rustFormatCheck,
+    external_checks_1.csharpFormatCheck,
+    external_checks_1.phpFormatCheck,
 ];

package/dist/core/run-checks.js

@@ -4,9 +4,12 @@ exports.applySeverity = applySeverity;
 exports.shouldReportDiffSkip = shouldReportDiffSkip;
 exports.runChecks = runChecks;
 const utils_1 = require("../utils");
+const package_version_1 = require("../utils/package-version");
 const pool_1 = require("../utils/pool");
+const resolve_bin_1 = require("../utils/resolve-bin");
 const result_collector_1 = require("../utils/result-collector");
 const context_1 = require("./context");
+const prepare_1 = require("./install/prepare");
 const registry_1 = require("./registry");
 const reporters_1 = require("./reporters");
 const types_1 = require("./types");
@@ -107,13 +110,27 @@ function noDiffReason(ctx) {
         return `no diff range (${scope.reason}) — set fetch-depth: 0`;
     return 'full scan — this check reviews a diff';
 }
+/**
+ * Whether a skip came from the missing diff range, as opposed to any other reason
+ * a check can decline to run.
+ *
+ * `reportDegradedScope` counts these to say how much coverage a fallback to a full
+ * scan cost. It used to count every skip in the report, which already included
+ * unrelated ones ("mypy not installed"), and tooling skips would have added more —
+ * turning a number that means "checks you lost to a shallow clone" into "skips,
+ * roughly". Matched on the phrasing {@link noDiffReason} produces, which is the
+ * only thing that distinguishes them once a skip is just a status and a string.
+ */
+function isDiffSkip(details) {
+    return Boolean(details && /^no diff range|^full scan — this check reviews a diff/.test(details));
+}
 /**
  * Run one check: gate on `applies`, execute, translate throws into `fail`.
  *
  * `heavy` admits only a couple of expensive checks at a time, and the per-check
  * timeout means one that never returns costs a warning rather than the run.
  */
-async function runOne(check, ctx, collector, heavy) {
+async function runOne(check, ctx, collector, heavy, tooling) {
     try {
         // A diff-only check without a range is usually a hole in coverage rather
         // than an irrelevance, so it is reported as a skip and the gap stays visible
@@ -141,6 +158,20 @@ async function runOne(check, ctx, collector, heavy) {
             // from run() (e.g. "no relevant files changed") are still reported.
             return;
         }
+        // Tooling is checked AFTER `applies`, so the row only appears for a check
+        // that would otherwise have run. A Ruff row in a TypeScript repository would
+        // be noise; a Ruff row in a Python repository whose toolchain never arrived
+        // is the whole point — ticket 057, applied to tooling instead of diffs.
+        const missing = tooling.unavailable.get(check.name);
+        if (missing) {
+            // Severity still has the last word, as it does for every other outcome: a
+            // client who made this check advisory does not get a hard failure out of
+            // `onMissingTool: "error"`, and one who promoted it does.
+            const status = applySeverity(check.name, tooling.fatal ? 'fail' : 'skip', ctx);
+            utils_1.logger.warn(`[runChecks]: ${status === 'fail' ? '❌' : '⏭️'} ${check.name}: ${missing}`);
+            collector.register(check.name, status, `tooling unavailable — ${missing}`);
+            return;
+        }
         const started = Date.now();
         const timeoutMs = ctx.config.run?.checkTimeoutMs ?? 300000;
         const execute = () => (0, pool_1.withTimeout)(check.run(ctx), timeoutMs, () => {
@@ -180,12 +211,16 @@ async function runChecks(opts = {}) {
     // the list from here rather than importing the registry, which would make
     // registry → check → registry a cycle.
     ctx.checkNames = resolveChecks(opts).map(c => c.name);
+    // Before any check starts: make sure the tools they need are reachable, and
+    // learn which ones are not. Doing this per-check would fetch the same profile
+    // from several checks at once and leave each of them guessing on failure.
+    const tooling = await prepareToolingFor(ctx, selected);
     const limit = (0, pool_1.resolveConcurrency)(ctx.config.run?.concurrency);
     const heavyLimit = Math.max(1, ctx.config.run?.heavyConcurrency ?? 1);
     const heavy = new pool_1.Semaphore(heavyLimit);
     for (const phase of types_1.PHASES) {
         const inPhase = selected.filter(c => c.phase === phase);
-        await (0, pool_1.runPool)(inPhase.map(c => () => runOne(c, ctx, collector, heavy)), limit);
+        await (0, pool_1.runPool)(inPhase.map(c => () => runOne(c, ctx, collector, heavy, tooling)), limit);
     }
     reportDegradedScope(ctx, collector);
     const build = () => {
@@ -204,6 +239,40 @@ async function runChecks(opts = {}) {
     }
     return result;
 }
+/**
+ * Prepare the tooling the selected checks need, or explain what is missing.
+ *
+ * Separate from `prepareTooling` itself so the failure of the *preparation* is
+ * never the failure of the *run*: fetching tooling is best-effort by nature —
+ * offline runners, read-only caches, a registry having a bad day — and a throw
+ * here would take down a run that could still have done most of its job. The
+ * checks that needed the tooling report it themselves, one row each.
+ *
+ * `install.strategy: "manual"` and a caller that supplied its own checks both
+ * arrive here; neither is special-cased, because a profile whose packages ship
+ * with us needs no preparation either way and the loop exits having done nothing.
+ */
+async function prepareToolingFor(ctx, selected) {
+    try {
+        return await (0, prepare_1.prepareTooling)({
+            cwd: ctx.cwd,
+            config: ctx.config,
+            // A hand-built context (the SDK, a test) carries no counts. Treating its
+            // languages as real rather than marker-only is the honest reading: a caller
+            // that names a language is asserting it, not guessing.
+            usage: ctx.usage ?? ctx.languages.map(lang => ({ lang, files: 1, marker: true })),
+            selected: selected.map(c => c.name),
+            version: (0, package_version_1.packageVersion)(),
+        });
+    }
+    catch (err) {
+        utils_1.logger.warn(`[install]: ⚠️ could not prepare tooling: ${errMessage(err)}`);
+        // Preparation may have registered roots before it threw. Leaving them behind
+        // would point resolution at a half-installed directory for the whole run.
+        (0, resolve_bin_1.clearToolPaths)();
+        return (0, prepare_1.noTooling)();
+    }
+}
 /**
  * Surface a scope that silently narrowed the run.
  *
@@ -220,7 +289,9 @@ function reportDegradedScope(ctx, collector) {
     const mode = ctx.config.run?.onDegradedScope ?? 'warn';
     if (mode === 'off' || !ctx.scope?.degraded || !(0, utils_1.isCiEnvironment)())
         return;
-    const dropped = collector.getResults().filter(r => r.status === 'skip').length;
+    const dropped = collector
+        .getResults()
+        .filter(r => r.status === 'skip' && isDiffSkip(r.details)).length;
     const detail = `${ctx.scope.reason}; ${dropped} diff-only check(s) did not run — set fetch-depth: 0`;
     utils_1.logger.error(`[runChecks]: ${mode === 'error' ? '❌' : '⚠️'} Degraded scope: ${detail}`);
     collector.register('Scan Scope', mode === 'error' ? 'fail' : 'warn', detail);