pr-checkmate 2.1.2 → 3.0.1

package/dist/core/checks/languages/external-runner.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runTool = runTool;
+exports.defineExternalLint = defineExternalLint;
+exports.defineExternalFormat = defineExternalFormat;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const tool_install_1 = require("../tool-install");
+/**
+ * Run an external tool, telling an absent binary apart from a failing one.
+ *
+ * execa v9 with `reject: false` does NOT throw on a missing binary — it resolves
+ * with `code: 'ENOENT'`. Detecting that on the result rather than in a
+ * `try`/`catch` (which never fires here) is the difference between an honest skip
+ * and a missing linter reporting a clean pass. This comment used to be repeated
+ * verbatim in eleven files, which is roughly how long it takes for one of the
+ * copies to lose it.
+ */
+async function runTool(ctx, bin, args) {
+    const result = await (0, execa_1.execa)(bin, args, { cwd: ctx.cwd, reject: false });
+    if (result.code === 'ENOENT')
+        return { missing: true };
+    return {
+        missing: false,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+    };
+}
+/** Both streams as one blob — some tools diagnose on stdout, some on stderr. */
+function combinedOutput(run, stderrFirst) {
+    const streams = stderrFirst ? [run.stderr, run.stdout] : [run.stdout, run.stderr];
+    return streams.filter(Boolean).join('\n').trim();
+}
+/** Every non-blank line is a finding, unless a spec says otherwise. */
+function isNotBlank(line) {
+    return line.trim().length > 0;
+}
+/** `N issue(s)`, unless a spec phrases its count differently. */
+function countIssues(lines) {
+    return `${lines.length} issue(s)`;
+}
+/** Whether a language check is switched on for this repository. */
+function isEnabled(ctx, key, language) {
+    if (ctx.config[key]?.enabled === false)
+        return false;
+    return language === undefined || ctx.languages.includes(language);
+}
+/**
+ * Assemble the `Check` both factories return, given the part that differs.
+ *
+ * Everything here is identical between a linter and a formatter — the name, the
+ * `applies` gate, and resolving the files — and only `phase` and `work` are not.
+ * Kept as a third function rather than merged into one factory with a flag,
+ * because the two specs are genuinely different shapes: a linter reads output, a
+ * formatter runs twice and may write. One factory would mean a spec with half its
+ * fields unused, which is the trade this file's header argues against.
+ */
+function defineExternal(spec, phase, work) {
+    return {
+        name: spec.name,
+        phase,
+        applies(ctx) {
+            return isEnabled(ctx, spec.configKey, spec.language);
+        },
+        async run(ctx) {
+            const targets = await (0, targets_1.resolveTargets)(ctx, spec.globs, {
+                onEmpty: { pass: `no ${spec.subject} changed` },
+            });
+            if (!Array.isArray(targets))
+                return targets;
+            return work(ctx, targets);
+        },
+    };
+}
+/**
+ * Build an informational lint check from its spec.
+ *
+ * Informational for all of them, and not a field: these checks depend on a tool
+ * we do not ship, so on a runner without it they cannot distinguish clean code
+ * from unexamined code. A gate that silently stops gating is worse than no gate,
+ * and a client who wants one promotes the check with `severity`.
+ */
+function defineExternalLint(spec) {
+    return defineExternal(spec, 'informational', async (ctx, targets) => {
+        const run = await runTool(ctx, spec.bin, spec.args(ctx, targets));
+        if (run.missing)
+            return (0, tool_install_1.notInstalled)(spec.tool, spec.toolLabel);
+        const output = combinedOutput(run, spec.stderrFirst);
+        // Exit 0 is the tool's verdict. Empty output on a non-zero exit is a tool
+        // that objected without saying to what, and there is nothing to put in a
+        // report either way — so both are a pass rather than a warn reading
+        // "0 issue(s)".
+        if (run.exitCode === 0 || !output) {
+            utils_1.logger.info(`[${spec.name}]: ✅ No issues found`);
+            return (0, types_1.pass)();
+        }
+        const lines = output.split('\n').filter(spec.keep ?? isNotBlank);
+        // The tool objected and none of its output matched what this check knows how
+        // to read — a build error ahead of the lint pass, usually. Naming the exit
+        // code is thin, but a clean pass over an objection is a lie.
+        const summary = lines.length > 0
+            ? (spec.summary ?? countIssues)(lines, targets)
+            : `${spec.bin} exited ${run.exitCode ?? 'without a code'} with no readable diagnostics`;
+        (0, findings_1.logSample)(spec.name, `${summary}:`, lines);
+        return (0, types_1.warn)(summary);
+    });
+}
+/**
+ * Build a format check from its spec: detect, then rewrite only when asked.
+ *
+ * The two passes are deliberate. A check run must never change the tree unless
+ * the caller said `write`, and in `write` mode CI needs the files actually
+ * rewritten so it can commit them — so the read-only pass is the one that decides
+ * the verdict, and the second only carries it out.
+ */
+function defineExternalFormat(spec) {
+    return defineExternal(spec, 'format', async (ctx, targets) => {
+        const dry = await runTool(ctx, spec.bin, spec.checkArgs(targets));
+        if (dry.missing)
+            return (0, tool_install_1.notInstalled)(spec.tool, spec.toolLabel);
+        if (dry.exitCode === 0)
+            return (0, types_1.pass)();
+        if (!ctx.write) {
+            utils_1.logger.warn(`[${spec.name}]: ⚠️ ${spec.code} needs formatting`);
+            return (0, types_1.warn)(`${spec.code} needs formatting (run with write to fix)`);
+        }
+        const fix = await runTool(ctx, spec.bin, spec.writeArgs(targets));
+        // `missing` cannot happen here — the same binary answered a moment ago — but
+        // it is a case of the type, and collapsing it into the failure branch is both
+        // correct and shorter than asserting it away.
+        if (fix.missing || fix.exitCode !== 0) {
+            const detail = fix.missing ? '' : `\n${fix.stderr}`;
+            utils_1.logger.warn(`[${spec.name}]: ⚠️ ${spec.bin} failed to rewrite files${detail}`);
+            return (0, types_1.warn)(`${spec.bin} failed to rewrite files`);
+        }
+        utils_1.logger.info(`[${spec.name}]: ✅ Reformatted ${spec.code}`);
+        return (0, types_1.pass)(`reformatted ${spec.code}`);
+    });
+}

package/dist/core/checks/languages/go-format.d.ts

@@ -1,8 +1,8 @@
 import { Check } from '../../types';
 /**
- * Formats changed Go files with `gofmt`. Runner-dependency (needs `gofmt` on the
- * runner), gracefully skipping when absent. Read-only in check mode (`gofmt -l`
- * lists files that differ from gofmt output); rewrites in place with `gofmt -w`
- * when `write`, so CI can auto-commit — mirrors the Prettier/C++/Ruff format checks.
+ * Formats changed Go files with gofmt — the runner's own when it has one, and a
+ * bundled WASM build otherwise, so the check has no runner dependency at all.
+ * Read-only in check mode; rewrites in place when `write`, so CI can auto-commit
+ * — mirrors the Prettier/C++/Ruff format checks.
  */
 export declare const goFormatCheck: Check;

package/dist/core/checks/languages/go-format.js

@@ -1,16 +1,146 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.goFormatCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
 const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
+const tool_install_1 = require("../tool-install");
+const external_runner_1 = require("./external-runner");
 const GO_GLOBS = ['*.go'];
 /**
- * Formats changed Go files with `gofmt`. Runner-dependency (needs `gofmt` on the
- * runner), gracefully skipping when absent. Read-only in check mode (`gofmt -l`
- * lists files that differ from gofmt output); rewrites in place with `gofmt -w`
- * when `write`, so CI can auto-commit — mirrors the Prettier/C++/Ruff format checks.
+ * Load the bundled WASM gofmt, or explain why it could not be loaded.
+ *
+ * This is what stopped `⏭️ Go Format: gofmt not installed` from being the answer
+ * on every runner without a Go toolchain — a ~285 KB WASM build of gofmt does
+ * the same job with nothing to install, the same way Ruff covers Python and
+ * clang-format covers C++.
+ *
+ * Three details, each of which was a way to get this wrong:
+ *
+ * - **Resolved through `resolvePackageBin`, not a bare specifier.** The package
+ *   may live in a fetched profile directory rather than in our own tree, and only
+ *   the resolver knows about those. A bare `import('@wasm-fmt/gofmt')` resolves
+ *   relative to this file and would miss it.
+ * - **`gofmt_node.js` explicitly**, because the package's `exports` map routes
+ *   `.` per runtime and the node entry is the one that reads the `.wasm` off disk.
+ * - **A dynamic `import()`.** The package is ESM and we emit CommonJS;
+ *   `require` cannot load it, and TypeScript preserves dynamic `import()` in CJS
+ *   output under `module: NodeNext` precisely so this works.
+ */
+async function loadBundledGofmt() {
+    try {
+        const entry = (0, utils_1.resolvePackageBin)('@wasm-fmt/gofmt', 'gofmt_node.js');
+        const mod = (await import((0, node_url_1.pathToFileURL)(entry).href));
+        return mod.format;
+    }
+    catch (err) {
+        utils_1.logger.warn(`[Go Format]: ⚠️ bundled gofmt could not be loaded\n${err}`);
+        return null;
+    }
+}
+/**
+ * The verdict, given the files that turned out to need formatting.
+ *
+ * Shared by both routes on purpose. It was written out twice — once after
+ * `gofmt -l` and once after the in-memory comparison — and the two copies are how
+ * the wording of a verdict comes to depend on whether Go happens to be installed
+ * on the runner (ticket 079). What a client is told about their code must not be a
+ * function of our own resolution order.
+ *
+ * Called only once the rewriting, if any, is done — so reaching the last branch
+ * means the files really were rewritten and CI has something to commit. The
+ * routes differ in when that happens (the system route shells out to `gofmt -w`,
+ * the bundled one wrote each file as it went) and in nothing this function can
+ * see.
+ */
+function verdictFor(ctx, unformatted) {
+    if (unformatted.length === 0)
+        return (0, types_1.pass)();
+    if (!ctx.write) {
+        utils_1.logger.warn(`[Go Format]: ⚠️ ${unformatted.length} Go file(s) need formatting`);
+        unformatted.slice(0, 10).forEach(file => utils_1.logger.warn(`  ${file}`));
+        return (0, types_1.warn)(`${unformatted.length} file(s) need formatting (run with write to fix)`);
+    }
+    utils_1.logger.info(`[Go Format]: ✅ Reformatted ${unformatted.length} Go file(s)`);
+    return (0, types_1.pass)(`reformatted ${unformatted.length} file(s)`);
+}
+/**
+ * Format with the runner's own `gofmt`, when it has one.
+ *
+ * Tried ahead of the bundled copy on purpose, and it is the same policy as
+ * preferring a repo's `.clang-format` or its own ESLint: gofmt's output is a
+ * function of the Go release, and the one release we know a repository agrees
+ * with is the one installed beside it. Reaching for ours first would mean
+ * rewriting a Go 1.18 tree by current rules in `write` mode — us and their CI
+ * reformatting the same files in opposite directions.
+ *
+ * @returns The outcome, or `null` when there is no system `gofmt` to ask.
+ */
+async function formatWithSystemGofmt(ctx, targets) {
+    const list = await (0, external_runner_1.runTool)(ctx, 'gofmt', ['-l', ...targets]);
+    if (list.missing)
+        return null;
+    const unformatted = list.stdout.split('\n').filter(Boolean);
+    // Decided before the rewrite, so a read-only run answers without `gofmt -w`
+    // having been considered at all.
+    if (unformatted.length === 0 || !ctx.write)
+        return verdictFor(ctx, unformatted);
+    const fix = await (0, external_runner_1.runTool)(ctx, 'gofmt', ['-w', ...unformatted]);
+    if (fix.missing || fix.exitCode !== 0) {
+        utils_1.logger.warn(`[Go Format]: ⚠️ gofmt -w failed\n${fix.missing ? '' : fix.stderr}`);
+        return (0, types_1.warn)('gofmt failed to rewrite files');
+    }
+    return verdictFor(ctx, unformatted);
+}
+/**
+ * Format in-process with the bundled WASM gofmt — the route taken on a runner
+ * with no Go toolchain, which is most of them.
+ *
+ * Compares rather than trusting an exit code, because the WASM build is a
+ * library and not a CLI: it formats a string and says nothing about whether it
+ * changed anything. Mirrors the Ruff format check for that reason.
+ */
+function formatWithBundledGofmt(ctx, targets, format) {
+    const unformatted = [];
+    for (const rel of targets) {
+        const abs = node_path_1.default.join(ctx.cwd, rel);
+        let content;
+        try {
+            content = node_fs_1.default.readFileSync(abs, 'utf-8');
+        }
+        catch {
+            continue; // renamed or removed between the diff and the read
+        }
+        let formatted;
+        try {
+            formatted = format(content);
+        }
+        catch (err) {
+            // gofmt parses before it formats, so a throw here is a syntax error. That
+            // is Go Vet's finding to report, not a formatting verdict — and calling it
+            // one sends people looking for a style problem that does not exist.
+            utils_1.logger.warn(`[Go Format]: ⚠️ could not parse ${rel} (syntax error?)\n${err}`);
+            continue;
+        }
+        if (formatted === content)
+            continue;
+        unformatted.push(rel);
+        if (ctx.write)
+            node_fs_1.default.writeFileSync(abs, formatted);
+    }
+    return verdictFor(ctx, unformatted);
+}
+/**
+ * Formats changed Go files with gofmt — the runner's own when it has one, and a
+ * bundled WASM build otherwise, so the check has no runner dependency at all.
+ * Read-only in check mode; rewrites in place when `write`, so CI can auto-commit
+ * — mirrors the Prettier/C++/Ruff format checks.
  */
 exports.goFormatCheck = {
     name: 'Go Format',
@@ -19,30 +149,21 @@ exports.goFormatCheck = {
         return ctx.config.go?.enabled !== false && ctx.languages.includes('go');
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveTargetFiles)(ctx, GO_GLOBS);
-        if (targets === null)
-            return (0, types_1.skip)('git unavailable');
-        if (targets.length === 0)
-            return (0, types_1.pass)('no Go files changed');
-        const list = await (0, execa_1.execa)('gofmt', ['-l', ...targets], { cwd: ctx.cwd, reject: false });
-        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'` when
-        // the binary is absent — detect the missing toolchain on the result.
-        if (list.code === 'ENOENT')
-            return (0, types_1.skip)('gofmt not installed');
-        const unformatted = list.stdout.split('\n').filter(Boolean);
-        if (unformatted.length === 0)
-            return (0, types_1.pass)();
-        if (!ctx.write) {
-            utils_1.logger.warn(`[Go Format]: ⚠️ ${unformatted.length} Go file(s) need formatting`);
-            unformatted.slice(0, 10).forEach(f => utils_1.logger.warn(`  ${f}`));
-            return (0, types_1.warn)(`${unformatted.length} file(s) need formatting (run with write to fix)`);
-        }
-        const fix = await (0, execa_1.execa)('gofmt', ['-w', ...unformatted], { cwd: ctx.cwd, reject: false });
-        if (fix.exitCode !== 0) {
-            utils_1.logger.warn(`[Go Format]: ⚠️ gofmt -w failed\n${fix.stderr}`);
-            return (0, types_1.warn)('gofmt failed to rewrite files');
-        }
-        utils_1.logger.info(`[Go Format]: ✅ Reformatted ${unformatted.length} Go file(s)`);
-        return (0, types_1.pass)(`reformatted ${unformatted.length} file(s)`);
+        const targets = await (0, targets_1.resolveTargets)(ctx, GO_GLOBS, {
+            onEmpty: { pass: 'no Go files changed' },
+        });
+        if (!Array.isArray(targets))
+            return targets;
+        const viaSystem = await formatWithSystemGofmt(ctx, targets);
+        if (viaSystem)
+            return viaSystem;
+        const format = await loadBundledGofmt();
+        // Neither route: no Go toolchain on the runner AND our own copy could not be
+        // loaded, which means a partial install of this package. Installing Go is
+        // the fix a client can actually act on.
+        if (!format)
+            return (0, tool_install_1.notInstalled)('gofmt', 'gofmt');
+        utils_1.logger.debug('[Go Format]: no system gofmt — using the bundled WASM formatter');
+        return formatWithBundledGofmt(ctx, targets, format);
     },
 };

package/dist/core/checks/languages/lint.js

@@ -4,20 +4,23 @@ exports.lintCheck = void 0;
 const config_1 = require("../../../config");
 const utils_1 = require("../../../utils");
 const execa_1 = require("../../../utils/execa");
+const reuse_1 = require("../../install/reuse");
 const targets_1 = require("../../targets");
 const types_1 = require("../../types");
 /**
- * Resolve the ESLint binary, preferring the consumer project's own copy so a
- * repo pinned to ESLint 8 (+ legacy `.eslintrc.*`) keeps working. Falls back to
- * the version bundled with pr-checkmate when the project has no local install.
+ * Resolve the ESLint binary under the client's `install.reuseLocal` policy.
+ *
+ * A repo pinned to ESLint 8 with a legacy `.eslintrc.*` must run ITS ESLint —
+ * ours does not read eslintrc — so when the client owns the config the version is
+ * not asked about. When the config is the flat one WE generate, it is: ESLint 8
+ * cannot read it, and reusing their copy there produced a failure about our
+ * configuration rather than about their code. That asymmetry is the whole reason
+ * `clientOwnsConfig` exists (ticket 064, lever A).
  */
-function resolveESLintBin(cwd) {
-    try {
-        return (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js', { paths: [cwd] });
-    }
-    catch {
-        return (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js');
-    }
+function resolveESLintBin(ctx, clientOwnsConfig) {
+    return (0, utils_1.resolvePackageBin)('eslint', 'bin/eslint.js', {
+        paths: (0, reuse_1.clientToolPaths)('eslint', ctx, { clientOwnsConfig }),
+    });
 }
 async function getESLintMajorVersion(eslintBin) {
     try {
@@ -36,19 +39,16 @@ exports.lintCheck = {
         return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
     },
     async run(ctx) {
-        const eslintBin = resolveESLintBin(ctx.cwd);
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.pass)('no TypeScript/JavaScript files to lint');
-        const hasLocal = (0, config_1.hasLocalConfig)([
-            'eslint.config.mjs',
-            'eslint.config.js',
-            '.eslintrc.js',
-            '.eslintrc.json',
-            '.eslintrc',
-        ]);
+        // Whose config decides whose binary, so this is read BEFORE resolving one.
+        // It used to be the other way round, which is how a client's ESLint 8 ended
+        // up pointed at the flat config we generate.
+        const hasLocal = (0, config_1.hasLocalConfig)(['eslint.config.mjs', 'eslint.config.js', '.eslintrc.js', '.eslintrc.json', '.eslintrc'], ctx.cwd);
+        const eslintBin = resolveESLintBin(ctx, hasLocal);
         const version = await getESLintMajorVersion(eslintBin);
         const args = [...targets];
         // `--ext` is an eslintrc-only flag. Under flat config (ESLint 9+) it is

package/dist/core/checks/languages/prettier.js

@@ -42,7 +42,7 @@ exports.prettierCheck = {
         return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.json', '*.md'], (0, config_1.getSourcePaths)());
+        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.json', '*.md'], (0, config_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
@@ -57,12 +57,7 @@ exports.prettierCheck = {
             ignorePath = gitignore;
         else
             ignorePath = tempIgnore = createTempIgnoreFile(ctx.cwd);
-        const hasLocal = (0, config_1.hasLocalConfig)([
-            '.prettierrc',
-            '.prettierrc.json',
-            '.prettierrc.js',
-            'prettier.config.js',
-        ]);
+        const hasLocal = (0, config_1.hasLocalConfig)(['.prettierrc', '.prettierrc.json', '.prettierrc.js', 'prettier.config.js'], ctx.cwd);
         // write=true → format in place; write=false → report-only (`--check`, never mutates files).
         const mode = ctx.write ? '--write' : '--check';
         let tempConfig = null;

package/dist/core/checks/languages/python-typecheck.d.ts

@@ -1,9 +1,14 @@
 import { Check } from '../../types';
 /**
- * Type-checks changed Python files — the Python analogue of the TypeScript
- * `tsc --noEmit` check. Runner-dependency (needs mypy or pyright on the runner),
- * gracefully skipping when neither is present. Informational by design (like
- * Ruff lint) so teams can adopt gradually; force a checker with
- * `python.typeChecker`, else mypy is tried first, then pyright.
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
  */
 export declare const pythonTypecheckCheck: Check;