pr-checkmate 3.0.1 → 3.0.2

package/dist/core/checks/quality/package-size.d.ts

@@ -1,4 +1,25 @@
 import { Check } from '../../types';
+/** Why we could not read a published version. */
+export type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
+/**
+ * Tell "never published" apart from "we were not let in".
+ *
+ * Lumped into one sentence they read the same and they are not: one is a fact
+ * about the package, the other is about this run's credentials. A skip whose
+ * reason is a guess between two causes is the defect of ticket 057, one layer up.
+ *
+ * A 401 is also evidence in itself, and it points one way: a name nobody ever
+ * published answers 404 on the public registry, while 401 comes from a host that
+ * has the package and will not show it to a stranger. So the message leads with
+ * the token, which is what that situation actually needs.
+ *
+ * It deliberately does NOT suggest `"private": true` as the way out. That field
+ * means "never publish this", and a package behind a private registry is
+ * published — advising it would break the publish step of the very repository
+ * asking. `packageSize.enabled: false` silences the row and touches nothing
+ * else, so that is the opt-out worth naming.
+ */
+export declare function classifyQueryFailure(stderr: string): QueryFailure;
 /**
  * Reports how much the published package grew since the last release.
  *

package/dist/core/checks/quality/package-size.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.packageSizeCheck = void 0;
+exports.classifyQueryFailure = classifyQueryFailure;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../../utils");
@@ -31,19 +32,57 @@ const NAMED_FILES = 5;
  *
  * @param cwd Repository to run in.
  * @param spec `undefined` for the working tree, or `name@tag` for a release.
+ * @param registry Where to look for a published version; the manifest's own
+ *   `publishConfig.registry` when it names one.
  */
-async function packManifest(cwd, spec) {
-    const args = ['pack', ...(spec ? [spec] : []), '--dry-run', '--json', '--ignore-scripts'];
+async function packManifest(cwd, spec, registry) {
+    const args = [
+        'pack',
+        ...(spec ? [spec] : []),
+        '--dry-run',
+        '--json',
+        '--ignore-scripts',
+        ...(registry ? ['--registry', registry] : []),
+    ];
     const result = await (0, execa_1.execa)('npm', args, { cwd, reject: false });
     if (result.exitCode !== 0)
-        return null;
+        return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
         const parsed = JSON.parse(result.stdout);
-        return Array.isArray(parsed) && parsed.length > 0 ? parsed[0] : null;
+        if (Array.isArray(parsed) && parsed.length > 0) {
+            return { manifest: parsed[0] };
+        }
     }
     catch {
-        return null;
+        // Fall through: npm answered with something that is not a manifest.
+    }
+    return { failure: 'unreadable' };
+}
+/**
+ * Tell "never published" apart from "we were not let in".
+ *
+ * Lumped into one sentence they read the same and they are not: one is a fact
+ * about the package, the other is about this run's credentials. A skip whose
+ * reason is a guess between two causes is the defect of ticket 057, one layer up.
+ *
+ * A 401 is also evidence in itself, and it points one way: a name nobody ever
+ * published answers 404 on the public registry, while 401 comes from a host that
+ * has the package and will not show it to a stranger. So the message leads with
+ * the token, which is what that situation actually needs.
+ *
+ * It deliberately does NOT suggest `"private": true` as the way out. That field
+ * means "never publish this", and a package behind a private registry is
+ * published — advising it would break the publish step of the very repository
+ * asking. `packageSize.enabled: false` silences the row and touches nothing
+ * else, so that is the opt-out worth naming.
+ */
+function classifyQueryFailure(stderr) {
+    if (/\bE?40[13]\b|Unauthorized|Forbidden|authentication token/i.test(stderr)) {
+        return 'unauthenticated';
     }
+    if (/\bE?404\b|Not found/i.test(stderr))
+        return 'absent';
+    return 'unreadable';
 }
 /** `1.15 MB`, at the precision a human compares two of these at. */
 function mb(bytes) {
@@ -66,11 +105,21 @@ function growthByFile(before, after) {
         .slice(0, NAMED_FILES)
         .map(f => `${f.path} +${mb(f.delta)}${f.isNew ? ' (new)' : ''}`);
 }
-/** Whether this repository publishes anything to compare. */
-function publishedName(cwd) {
+/** What this repository publishes, and where — or `null` if it publishes nothing. */
+function published(cwd) {
     try {
         const pkg = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(cwd, 'package.json'), 'utf-8'));
-        return pkg.private || !pkg.name ? null : pkg.name;
+        if (pkg.private || !pkg.name)
+            return null;
+        // `publishConfig.registry` is the manifest's own statement of where this
+        // package lives, and npm uses it for `publish` but not for a fetch. Asking
+        // the default registry instead reports "no published version" for every
+        // package on GitHub Packages or a company mirror — which is not a fact about
+        // the package, it is us having asked the wrong host. Measured on a real
+        // client: the default registry answered 404 for a package published at
+        // version 1.2.15.
+        const registry = pkg.publishConfig?.registry;
+        return registry ? { name: pkg.name, registry } : { name: pkg.name };
     }
     catch {
         return null;
@@ -98,33 +147,57 @@ exports.packageSizeCheck = {
             return false;
         // A private package is never published, so there is nothing to compare with
         // and no consumer to pay for the growth.
-        return publishedName(ctx.cwd) !== null;
+        return published(ctx.cwd) !== null;
     },
     async run(ctx) {
-        const name = publishedName(ctx.cwd);
-        if (!name)
+        const target = published(ctx.cwd);
+        if (!target)
             return (0, types_1.skip)('no publishable package.json');
         const tag = ctx.config.packageSize?.compareWith ?? 'latest';
         const maxGrowth = ctx.config.packageSize?.maxGrowthPercent ?? DEFAULT_MAX_GROWTH;
-        const current = await packManifest(ctx.cwd);
-        if (!current)
+        const spec = `${target.name}@${tag}`;
+        const local = await packManifest(ctx.cwd);
+        if (!('manifest' in local))
             return (0, types_1.skip)('npm could not describe this package');
-        // Registry unreachable, or nothing published yet. Both are "we could not
-        // look", never "nothing changed" — a pass here would be a green row over a
-        // comparison that never happened (ticket 072).
-        const published = await packManifest(ctx.cwd, `${name}@${tag}`);
-        if (!published) {
-            return (0, types_1.skip)(`no published ${name}@${tag} to compare with (or registry unreachable)`);
+        const current = local.manifest;
+        // Never a pass: a green row over a comparison that did not happen is the
+        // mistake of ticket 072. And never one reason standing in for three — the
+        // three are different situations for the reader, and only one of them is a
+        // fact about the package rather than about the run.
+        const remote = await packManifest(ctx.cwd, spec, target.registry);
+        if (!('manifest' in remote)) {
+            // The fact, and nothing past it. The remedy for a private registry is three
+            // lines in a workflow — `setup-node` with `registry-url`, a scope, and
+            // `NODE_AUTH_TOKEN`, because npm reads the token through a reference in
+            // `.npmrc` — and instructions that do not fit cannot be followed. They
+            // belong on the check's page, which the report already links to.
+            //
+            // The package name is left out on purpose: the reader owns it. The host is
+            // not, because it is the one part they cannot infer — and the difference
+            // between "we asked the wrong registry" and "we were refused" is exactly
+            // what this row got wrong before.
+            // Named only when we know it. Without `publishConfig.registry` npm used
+            // whatever the client's own config points at, and we do not know what that
+            // was — "at the registry" would be filler dressed up as information.
+            const host = target.registry ? new URL(target.registry).host : null;
+            const at = host ? ` at ${host}` : '';
+            const reason = {
+                absent: `nothing published under this name${at} yet`,
+                unauthenticated: `no credentials for ${host ?? 'the registry'}`,
+                unreadable: `could not read the published version${at}`,
+            }[remote.failure];
+            return (0, types_1.skip)(reason);
         }
-        const delta = current.unpackedSize - published.unpackedSize;
-        const growth = published.unpackedSize > 0 ? (delta / published.unpackedSize) * 100 : 0;
-        const summary = `${mb(published.unpackedSize)} → ${mb(current.unpackedSize)} ` +
-            `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${published.version}`;
+        const previous = remote.manifest;
+        const delta = current.unpackedSize - previous.unpackedSize;
+        const growth = previous.unpackedSize > 0 ? (delta / previous.unpackedSize) * 100 : 0;
+        const summary = `${mb(previous.unpackedSize)} → ${mb(current.unpackedSize)} ` +
+            `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${previous.version}`;
         if (growth <= maxGrowth) {
             utils_1.logger.info(`[Package Size]: ✅ ${summary}`);
             return (0, types_1.pass)(summary);
         }
-        (0, findings_1.logSample)('Package Size', `${summary}:`, growthByFile(published.files, current.files));
+        (0, findings_1.logSample)('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
         return (0, types_1.warn)(summary);
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "3.0.1",
+    "version": "3.0.2",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",