pr-checkmate 3.0.3 → 3.1.0

package/dist/esm/config/constants.js

@@ -0,0 +1,360 @@
+/**
+ * Build output, dependency, tooling, and report directories that are never
+ * product code. Every check excludes them by directory-name segment match (see
+ * `targets.ts`): a match on any segment of a path drops the file. Untracked
+ * build dirs are already excluded because checks read git-tracked files only —
+ * this list additionally covers dirs that repos commonly *commit* (`.github`,
+ * `.vscode`, `.idea`, `.claude`) and any checked-in build artifacts.
+ *
+ * Covers the common ecosystems: Node/JS/web, Python, Java/Kotlin/Gradle/Android,
+ * Swift/iOS/Xcode, and C/C++/CMake. Add more here.
+ */
+export const IGNORED_DIRS = [
+    // VCS, editors, and CI/tooling config
+    '.git',
+    '.github',
+    '.gitlab',
+    '.vscode',
+    '.vs',
+    '.idea',
+    '.claude',
+    '.cursor',
+    '.husky',
+    '.circleci',
+    // Node / JS / web — build output & caches
+    'node_modules',
+    'dist',
+    'build',
+    'build-release',
+    'out',
+    'coverage',
+    '.next',
+    '.nuxt',
+    '.svelte-kit',
+    '.turbo',
+    '.cache',
+    '.parcel-cache',
+    '.vercel',
+    '.wrangler',
+    '.serverless',
+    '.terraform',
+    // Python
+    '__pycache__',
+    '.pytest_cache',
+    '.mypy_cache',
+    '.ruff_cache',
+    '.tox',
+    '.venv',
+    'venv',
+    '.eggs',
+    'htmlcov',
+    // Java / Kotlin / Gradle / Android
+    '.gradle',
+    '.kotlin',
+    'target',
+    'gen',
+    'captures',
+    // Swift / iOS / Xcode
+    '.build',
+    '.swiftpm',
+    'DerivedData',
+    'Pods',
+    'Carthage',
+    // C / C++ / CMake
+    'CMakeFiles',
+    'cmake-build-debug',
+    'cmake-build-release',
+    '_deps',
+    // Test reports / results / logs / release artifacts
+    'reports',
+    'report',
+    'test-reports',
+    'test-report',
+    'test-output',
+    'test-results',
+    'results',
+    'result',
+    'logs',
+    'allure-report',
+    'allure-results',
+    'playwright-report',
+    '.wdio',
+    // Generated knowledge-graph output. Committed by repos that keep the graph in
+    // version control, and machine-written from end to end: a multi-megabyte
+    // `graph.json` trips the large-file check, and `GRAPH_REPORT.md` carries every
+    // identifier in the codebase past the spellchecker. Neither is anyone's source.
+    'graphify-out',
+];
+/**
+ * Glob form of the ignore list, for tools that take glob ignores directly
+ * (ESLint `--ignore-pattern`, cspell `--exclude`, the generated
+ * `.prettierignore`). Combines {@link IGNORED_DIRS} with a few tool-specific
+ * nested report globs that are not plain directory names.
+ */
+export const IGNORE_PATTERNS = [
+    ...IGNORED_DIRS.map(dir => `**/${dir}/**`),
+    // Tool-specific nested report dirs / files (not bare directory names)
+    '**/jest-html-reporters-*/**',
+    '**/jest-stare/**',
+    '**/cypress/reports/**',
+    '**/cypress/videos/**',
+    '**/cypress/screenshots/**',
+    '**/mochawesome-report/**',
+    '**/mochawesome-reports/**',
+    '**/target/surefire-reports/**',
+    '**/target/failsafe-reports/**',
+    '**/wdio-logs/**',
+    '**/lint-report/**',
+    '**/audit-report/**',
+];
+/**
+ * Where test code lives, as globs.
+ *
+ * Deliberately NOT part of {@link IGNORED_DIRS}: that list hides a directory from
+ * every check, and test code still wants linting, type-checking and formatting.
+ * What test code does not want is the handful of checks whose findings are noise
+ * on it — duplication (setup boilerplate repeats by design), unused exports (the
+ * runner consumes them), spelling (fixture identifiers) and the diff security
+ * scan (a test's whole job may be to call the dangerous thing). Each of those
+ * defaults to this list, and each lets a client replace it.
+ */
+export const TEST_PATH_GLOBS = [
+    '**/__tests__/**',
+    '**/__mocks__/**',
+    '**/*.test.*',
+    '**/*.spec.*',
+    '**/test/**',
+    '**/tests/**',
+];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+export const DUPLICATE_IGNORE_DEFAULTS = [...TEST_PATH_GLOBS];
+/**
+ * Paths the diff security scan skips by default.
+ *
+ * A security test corpus is built out of the exact constructs the scan hunts for
+ * — `eval()`, `document.write()`, `__proto__` — so scanning it turns every added
+ * test case into a finding, and under `severity: error` into a blocked merge.
+ * Clients can override via `diffSecurity.ignorePaths` (which REPLACES this list).
+ */
+export const DIFF_SECURITY_IGNORE_DEFAULTS = [...TEST_PATH_GLOBS];
+/**
+ * Files written by a release tool rather than by a person.
+ *
+ * `CHANGELOG.md` is assembled from commit subjects, so every typo anyone has ever
+ * committed reappears in it — 39 of 42 spellcheck findings in one real repository
+ * came from that one file, none of them actionable: the text cannot be corrected
+ * without rewriting git history, and the next release regenerates it anyway.
+ *
+ * Matched at ANY depth, not just at the repository root. The root-only form was
+ * the original, and it left every nested changelog unhandled: a component-config
+ * repository with one per component produced 157 of 157 spelling findings and 240
+ * of 246 markdown findings from files nobody writes by hand. A generated file is
+ * generated wherever it sits.
+ */
+export const GENERATED_DOC_FILES = ['**/CHANGELOG.md'];
+/**
+ * Files excluded from the dead-code (unused-exports) report by default. These are
+ * REGEX sources (matched against each reported file path), not globs — dead-code's
+ * `ignoreFiles` is regex-based. Test and mock files legitimately export helpers and
+ * mocks consumed only by the test runner (jest.mock, dynamic imports), which
+ * ts-unused-exports cannot see as usage, so flagging them is noise. Clients can
+ * override via `deadCode.ignoreFiles` in pr-checkmate.json (setting it replaces
+ * this list).
+ */
+export const DEAD_CODE_IGNORE_DEFAULTS = [
+    '/__tests__/',
+    '/__mocks__/',
+    '/__mock__/',
+    '/tests?/',
+    '\\.test\\.',
+    '\\.spec\\.',
+];
+export const CONFIG_FILE_PATTERNS = [
+    '**/*.config.js',
+    '**/*.config.cjs',
+    '**/*.config.mjs',
+    '**/*.config.ts',
+    '**/.eslintrc.*',
+    '**/eslint.config.*',
+    '**/jest.config.*',
+    '**/wdio.config.*',
+    '**/playwright.config.*',
+    '**/cypress.config.*',
+];
+/**
+ * jscpd formats the duplicate-CODE check scans. Restricting to code formats keeps
+ * config/CI YAML and JSON out of the report — they are data, not code, and their
+ * repetition is not meaningful duplication. This mirrors the code-only file set the
+ * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ *
+ * One entry per language pr-checkmate detects, all of them verified against the
+ * jscpd binary rather than assumed: the list used to stop at C++ while the check
+ * only ever handed jscpd `.ts`/`.js` files, so the Go, Rust, C#, Ruby and PHP
+ * halves were unreachable and the Python one was decoration. Copy-paste is a
+ * language-independent smell, and the tokenizer behind this check has always been
+ * able to see it — the file list was the only thing in the way.
+ */
+export const DUPLICATE_CODE_FORMATS = [
+    'javascript',
+    'typescript',
+    'jsx',
+    'tsx',
+    'python',
+    'kotlin',
+    'swift',
+    'c',
+    'cpp',
+    'csharp',
+    'go',
+    'php',
+    'ruby',
+    'rust',
+];
+/**
+ * File extensions to check
+ */
+export const SOURCE_EXTENSIONS = {
+    typescript: ['.ts', '.tsx'],
+    javascript: ['.js', '.jsx'],
+    markdown: ['.md', '.mdx'],
+    json: ['.json'],
+    all: ['.ts', '.tsx', '.js', '.jsx', '.json', '.md', '.mdx'],
+};
+export const DEFAULT_COMMANDS = {
+    'npx pr-checkmate init': 'Create pr-checkmate.json and the CI workflow (first-run setup)',
+    'npx pr-checkmate all': 'Run all checks over the changes — the PR diff in CI, your branch changes locally',
+    'npx pr-checkmate all --full': 'Run all checks over every tracked file, CI included',
+    'npx pr-checkmate lint': 'Lint code using ESLint',
+    'npx pr-checkmate prettier': 'Format code using Prettier',
+    'npx pr-checkmate deps': 'Check project dependencies',
+    'npx pr-checkmate npm-audit': 'Run package vulnerabilities check',
+    'npx pr-checkmate security': 'Security scan',
+    'npx pr-checkmate spellcheck': 'Run spellcheck via cspell',
+    'npx pr-checkmate typecheck': 'TypeScript type check (tsc --noEmit)',
+    'npx pr-checkmate diff-smell': 'Scan git diff for code smells',
+    'npx pr-checkmate pr-body': 'Validate PR description',
+    'npx pr-checkmate duplicate': 'Detect duplicate code blocks (jscpd)',
+};
+/**
+ * Packages allow-listed for the license check by default.
+ *
+ * These are the optional cspell language dictionaries. Some ship under copyleft
+ * licenses (GPL/LGPL), and a client who installs one to spellcheck their own
+ * language should not have that turn into a licence finding: the dictionary is
+ * data for our check, not code they ship.
+ */
+export const DEFAULT_ALLOW_PACKAGES = [
+    '@cspell/dict-es-es',
+    '@cspell/dict-fr-fr',
+    '@cspell/dict-he',
+    '@cspell/dict-ru_ru',
+    '@cspell/dict-uk-ua',
+];
+/**
+ * Canonical entry point to the PR CheckMate docs. Single source of truth: it is
+ * written into every generated `pr-checkmate.json` (via {@link documentation})
+ * and printed in the "new version available" notice, so the two can never drift.
+ */
+export const DOCS_URL = 'https://github.com/Mybono/pr_checkmate_public/tree/main/documentation';
+/**
+ * The fully annotated configuration, with every option at its default value.
+ *
+ * A URL rather than a file inside the package on purpose: half the audience runs
+ * pr-checkmate through `npx` on a pipeline and has no `node_modules` at all, so
+ * a path into the installed package is a dead end for them. The release workflow
+ * publishes `src/config/pr-checkmate.template.json` to the public mirror under
+ * this name, which keeps one copy for everyone.
+ */
+export const FULL_CONFIG_URL = 'https://github.com/Mybono/pr_checkmate_public/blob/main/pr-checkmate.json';
+export const documentation = {
+    pr_checkmate: DOCS_URL,
+    eslint: 'https://eslint.org/docs/latest/rules/',
+    typescriptEslint: 'https://typescript-eslint.io/rules/',
+    prettier: 'https://prettier.io/docs/en/options.html',
+    cspell: 'https://cspell.org/configuration/',
+};
+/**
+ * Every top-level key PR CheckMate recognises in pr-checkmate.json — the union
+ * of the `PRCheckMateConfig` interface fields and the keys the `init` generator
+ * writes (which use `eslint`/`cspell`/`markdownlint` rather than the interface's
+ * `lint`/`spellcheck`). The Config Validation check warns on any key not in this
+ * set (typos), ignoring `//`-prefixed comment keys and `$schema`. Keep in sync
+ * when adding a new configurable check.
+ */
+export const KNOWN_CONFIG_KEYS = new Set([
+    // core
+    'sourcePath',
+    'ignoreDirs',
+    'excludePaths',
+    'languages',
+    'detect',
+    'install',
+    'severity',
+    'severityDefaults',
+    'run',
+    'reporter',
+    'log',
+    'customRules',
+    '$schema',
+    'commands',
+    'documentation',
+    'configValidation',
+    // linters/formatters (interface + init aliases)
+    'lint',
+    'eslint',
+    'prettier',
+    'spellcheck',
+    'cspell',
+    'markdownlint',
+    'yamlLint',
+    'shellcheck',
+    'symlinks',
+    'typecheck',
+    // security
+    'security',
+    'diffSecurity',
+    'workflowSecurity',
+    'dockerfileSecurity',
+    'sensitiveFileGuard',
+    'migrationSafety',
+    // dependencies
+    'dependency',
+    'circularDeps',
+    'outdatedDeps',
+    'licenseCheck',
+    'vulnScan',
+    'grypeScan',
+    'bannedImports',
+    // git-diff / PR
+    'mergeConflict',
+    'diffSmell',
+    'leftoverDebug',
+    'todoFixme',
+    'lockfileDrift',
+    'largeFiles',
+    'missingTests',
+    'coverage',
+    'caseCollision',
+    'licenseHeader',
+    'duplicate',
+    'deadCode',
+    'packageSize',
+    'prBody',
+    'prSize',
+    'commitlint',
+    // languages
+    'cpp',
+    'python',
+    'swift',
+    'kotlin',
+    'go',
+    'rust',
+    'csharp',
+    'ruby',
+    'php',
+]);

package/dist/esm/config/index.d.ts

@@ -0,0 +1,40 @@
+export * from './constants.js';
+export { loadProjectConfig } from '../config/loader.js';
+/**
+ * The configured source path(s), normalised to a list.
+ *
+ * Accepts a string or an array; empty and invalid values fall back to `['.']`,
+ * the whole repository. Clients narrow scanning to a subdirectory by setting
+ * `sourcePath`.
+ *
+ * `cwd` is a parameter rather than `process.cwd()` baked in, and that is the
+ * whole of ticket 074. This used to read a `CONFIG_FILE` constant resolved at
+ * *module load*, so the answer was fixed to whatever directory the process
+ * started in — `chdir` could not change it and neither could a caller. For the
+ * CLI that is harmless, since its working directory never moves; for
+ * `runChecks({ cwd })` it meant the SDK consumer's own `sourcePath` was applied
+ * to somebody else's repository, silently scoping every scoped check to a
+ * directory that may not exist there.
+ *
+ * It also read the file itself, duplicating `loadProjectConfig` with its own
+ * defaults. One reader is now the only reader.
+ */
+export declare function getSourcePaths(cwd?: string): string[];
+/**
+ * The first configured source path, for callers that only support one directory.
+ * Prefer {@link getSourcePaths} for scan targets.
+ */
+export declare function getSourcePath(cwd?: string): string;
+/**
+ * Get the effective list of directory names excluded from every check
+ * (client `ignoreDirs` in pr-checkmate.json, or the curated default).
+ */
+export declare function getIgnoredDirs(cwd?: string): string[];
+/**
+ * Get path to package config files
+ */
+export declare function getPackageConfigPath(fileName: string): string;
+/**
+ * Check if project has local config
+ */
+export declare function hasLocalConfig(configNames: string[], cwd?: string): boolean;

package/dist/esm/config/index.js

@@ -0,0 +1,60 @@
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __dirnameFn } from 'node:path';
+const __dirname = __dirnameFn(__fileURLToPath(import.meta.url));
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadProjectConfig } from '../config/loader.js';
+import { findOwnPackageRoot } from '../utils/own-deps.js';
+export * from './constants.js';
+export { loadProjectConfig } from '../config/loader.js';
+/**
+ * The configured source path(s), normalised to a list.
+ *
+ * Accepts a string or an array; empty and invalid values fall back to `['.']`,
+ * the whole repository. Clients narrow scanning to a subdirectory by setting
+ * `sourcePath`.
+ *
+ * `cwd` is a parameter rather than `process.cwd()` baked in, and that is the
+ * whole of ticket 074. This used to read a `CONFIG_FILE` constant resolved at
+ * *module load*, so the answer was fixed to whatever directory the process
+ * started in — `chdir` could not change it and neither could a caller. For the
+ * CLI that is harmless, since its working directory never moves; for
+ * `runChecks({ cwd })` it meant the SDK consumer's own `sourcePath` was applied
+ * to somebody else's repository, silently scoping every scoped check to a
+ * directory that may not exist there.
+ *
+ * It also read the file itself, duplicating `loadProjectConfig` with its own
+ * defaults. One reader is now the only reader.
+ */
+export function getSourcePaths(cwd = process.cwd()) {
+    const { sourcePath } = loadProjectConfig(cwd);
+    const paths = (Array.isArray(sourcePath) ? sourcePath : [sourcePath]).filter((p) => typeof p === 'string' && p.trim().length > 0);
+    return paths.length > 0 ? paths : ['.'];
+}
+/**
+ * The first configured source path, for callers that only support one directory.
+ * Prefer {@link getSourcePaths} for scan targets.
+ */
+export function getSourcePath(cwd) {
+    return getSourcePaths(cwd)[0];
+}
+/**
+ * Get the effective list of directory names excluded from every check
+ * (client `ignoreDirs` in pr-checkmate.json, or the curated default).
+ */
+export function getIgnoredDirs(cwd) {
+    return loadProjectConfig(cwd).ignoreDirs ?? [];
+}
+/**
+ * Get path to package config files
+ */
+export function getPackageConfigPath(fileName) {
+    const packageRoot = findOwnPackageRoot() ?? path.resolve(__dirname, '../../..');
+    return path.join(packageRoot, fileName);
+}
+/**
+ * Check if project has local config
+ */
+export function hasLocalConfig(configNames, cwd = process.cwd()) {
+    return configNames.some(name => fs.existsSync(path.join(cwd, name)));
+}

package/dist/esm/config/loader.d.ts

@@ -0,0 +1,6 @@
+import { PRCheckMateConfig } from '../interfaces/index.js';
+/**
+ * Load project configuration from pr-checkmate.json
+ * Falls back to defaults if not found
+ */
+export declare function loadProjectConfig(cwd?: string): PRCheckMateConfig;

package/dist/esm/config/loader.js

@@ -0,0 +1,191 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger } from '../utils/index.js';
+import { DEAD_CODE_IGNORE_DEFAULTS, DEFAULT_ALLOW_PACKAGES, DUPLICATE_CODE_FORMATS, DUPLICATE_IGNORE_DEFAULTS, IGNORED_DIRS, } from './constants.js';
+/**
+ * Load project configuration from pr-checkmate.json
+ * Falls back to defaults if not found
+ */
+export function loadProjectConfig(cwd = process.cwd()) {
+    const configPath = path.join(cwd, 'pr-checkmate.json');
+    if (fs.existsSync(configPath)) {
+        try {
+            const content = fs.readFileSync(configPath, 'utf-8');
+            const config = JSON.parse(content);
+            return mergeWithDefaults(config);
+        }
+        catch (err) {
+            logger.warn(`[loadProjectConfig]: ⚠️ Failed to parse pr-checkmate.json: ${err}`);
+        }
+    }
+    return getDefaultConfig();
+}
+/**
+ * Deep merge user config with defaults
+ */
+function mergeWithDefaults(userConfig) {
+    const defaults = getDefaultConfig();
+    return {
+        // Preserve every key the user set — including opt-in checks (vulnScan,
+        // grypeScan) and controls with no default entry below (severity, customRules,
+        // prSize, caseCollision, go/rust/ruby/php, …). The explicitly-merged keys
+        // that follow override this spread with their default-merged values.
+        ...userConfig,
+        sourcePath: userConfig.sourcePath || defaults.sourcePath,
+        // Replace (not merge): the client sees the full default list in their
+        // generated config and edits it directly, so their list is authoritative.
+        ignoreDirs: userConfig.ignoreDirs ?? defaults.ignoreDirs,
+        lint: {
+            rules: { ...defaults.lint?.rules, ...userConfig.lint?.rules },
+            ignorePatterns: [
+                ...(defaults.lint?.ignorePatterns || []),
+                ...(userConfig.lint?.ignorePatterns || []),
+            ],
+        },
+        prettier: {
+            config: { ...defaults.prettier?.config, ...userConfig.prettier?.config },
+        },
+        spellcheck: {
+            words: [...(userConfig.spellcheck?.words || [])],
+            ignoreWords: [...(userConfig.spellcheck?.ignoreWords || [])],
+            ignorePaths: [
+                ...(defaults.spellcheck?.ignorePaths || []),
+                ...(userConfig.spellcheck?.ignorePaths || []),
+            ],
+        },
+        security: {
+            ...defaults.security,
+            ...userConfig.security,
+            gitleaks: { ...defaults.security?.gitleaks, ...userConfig.security?.gitleaks },
+            'npm-audit': { ...defaults.security?.['npm-audit'], ...userConfig.security?.['npm-audit'] },
+        },
+        typecheck: { ...defaults.typecheck, ...userConfig.typecheck },
+        cpp: {
+            ...defaults.cpp,
+            ...userConfig.cpp,
+            clangFormat: { ...defaults.cpp?.clangFormat, ...userConfig.cpp?.clangFormat },
+        },
+        python: {
+            ...defaults.python,
+            ...userConfig.python,
+            ruff: { ...defaults.python?.ruff, ...userConfig.python?.ruff },
+        },
+        swift: { ...defaults.swift, ...userConfig.swift },
+        kotlin: { ...defaults.kotlin, ...userConfig.kotlin },
+        diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
+        prBody: { ...defaults.prBody, ...userConfig.prBody },
+        duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
+        dependency: { ...defaults.dependency, ...userConfig.dependency },
+        outdatedDeps: { ...defaults.outdatedDeps, ...userConfig.outdatedDeps },
+        commitlint: { ...defaults.commitlint, ...userConfig.commitlint },
+        deadCode: { ...defaults.deadCode, ...userConfig.deadCode },
+        licenseCheck: {
+            allowPackages: [
+                ...(defaults.licenseCheck?.allowPackages || []),
+                ...(userConfig.licenseCheck?.allowPackages || []),
+            ],
+            allowLicenses: [
+                ...(defaults.licenseCheck?.allowLicenses || []),
+                ...(userConfig.licenseCheck?.allowLicenses || []),
+            ],
+        },
+    };
+}
+/**
+ * Get default configuration
+ */
+function getDefaultConfig() {
+    return {
+        sourcePath: '.',
+        ignoreDirs: [...IGNORED_DIRS],
+        lint: {
+            rules: {
+                'no-console': 'warn',
+                'no-debugger': 'error',
+                'prefer-const': 'error',
+                eqeqeq: ['error', 'always'],
+                '@typescript-eslint/no-unused-vars': [
+                    'error',
+                    { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+                ],
+                '@typescript-eslint/explicit-function-return-type': ['warn'],
+                '@typescript-eslint/no-explicit-any': ['warn'],
+                '@typescript-eslint/no-floating-promises': ['error'],
+                'max-len': ['warn', { code: 100 }],
+                semi: ['error', 'always'],
+                quotes: ['error', 'single', { avoidEscape: true }],
+                'object-curly-spacing': ['error', 'always'],
+                'keyword-spacing': ['error', { before: true, after: true }],
+            },
+            ignorePatterns: [
+                '**/node_modules/**',
+                '**/dist/**',
+                '**/.git/**',
+                '**/build/**',
+                '**/coverage/**',
+                '**/.next/**',
+            ],
+        },
+        prettier: {
+            config: {
+                semi: true,
+                singleQuote: true,
+                trailingComma: 'all',
+                bracketSpacing: true,
+                arrowParens: 'avoid',
+                printWidth: 100,
+                tabWidth: 2,
+            },
+        },
+        spellcheck: {
+            words: [],
+            ignoreWords: [],
+            ignorePaths: ['**/node_modules/**', '**/dist/**', '**/.git/**', '**/build/**'],
+        },
+        security: {
+            gitleaks: { enabled: true },
+            'npm-audit': { enabled: true, auditLevel: 'moderate' },
+        },
+        typecheck: { enabled: true },
+        cpp: { enabled: true, clangFormat: { style: 'LLVM' } },
+        python: { enabled: true, ruff: { lint: true, format: true } },
+        swift: { enabled: true },
+        kotlin: { enabled: true },
+        diffSmell: { enabled: true },
+        prBody: { enabled: true, minLength: 20, requireTicket: true },
+        duplicate: {
+            enabled: true,
+            minLines: 5,
+            minTokens: 50,
+            ignore: DUPLICATE_IGNORE_DEFAULTS,
+            formats: DUPLICATE_CODE_FORMATS,
+        },
+        dependency: { enabled: true, ignore: [] },
+        outdatedDeps: { enabled: true, ignore: [] },
+        deadCode: { enabled: true, ignoreFiles: DEAD_CODE_IGNORE_DEFAULTS },
+        commitlint: {
+            enabled: true,
+            types: [
+                'feat',
+                'fix',
+                'docs',
+                'chore',
+                'ci',
+                'refactor',
+                'perf',
+                'style',
+                'revert',
+                'test',
+                'build',
+            ],
+            // Skip release PRs and squash-merge titles that don't follow conventional
+            // commits (e.g. "Release 15 (#114)"). commitlint already ignores literal
+            // "Merge"/"Revert" messages, but not GitHub squash-merge PR titles.
+            ignores: ['^Release\\b', '^chore\\(release\\):'],
+        },
+        licenseCheck: {
+            allowPackages: [...DEFAULT_ALLOW_PACKAGES],
+            allowLicenses: [],
+        },
+    };
+}