pr-checkmate 3.0.3 → 3.1.0

package/dist/esm/core/checks/languages/python-lint.d.ts

@@ -0,0 +1,9 @@
+import { Check } from '../../types.js';
+/**
+ * Lints changed Python files with Ruff, bundled as a self-contained WASM module
+ * (`@astral-sh/ruff-wasm-nodejs`) so it runs on a bare Node image with no Python
+ * or pip install. Informational by design — reports issues without failing the
+ * build, matching how formatting checks roll out; promote to blocking per repo
+ * once teams have adopted it. Uses Ruff's default rule set (pyflakes + pycodestyle).
+ */
+export declare const pythonLintCheck: Check;

package/dist/esm/core/checks/languages/python-lint.js

@@ -0,0 +1,55 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger } from '../../../utils/index.js';
+import { resolveTargetFiles } from '../../targets.js';
+import { pass, warn, skip } from '../../types.js';
+import { PY_GLOBS, createRuffWorkspace } from './ruff-shared.js';
+/**
+ * Lints changed Python files with Ruff, bundled as a self-contained WASM module
+ * (`@astral-sh/ruff-wasm-nodejs`) so it runs on a bare Node image with no Python
+ * or pip install. Informational by design — reports issues without failing the
+ * build, matching how formatting checks roll out; promote to blocking per repo
+ * once teams have adopted it. Uses Ruff's default rule set (pyflakes + pycodestyle).
+ */
+export const pythonLintCheck = {
+    name: 'Ruff Lint',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.python?.enabled !== false &&
+            ctx.config.python?.ruff?.lint !== false &&
+            ctx.languages.includes('python'));
+    },
+    async run(ctx) {
+        const targets = await resolveTargetFiles(ctx, PY_GLOBS);
+        if (targets === null)
+            return skip('git unavailable');
+        if (targets.length === 0)
+            return pass('no Python files changed');
+        const workspace = createRuffWorkspace();
+        let totalIssues = 0;
+        let filesWithIssues = 0;
+        for (const rel of targets) {
+            let content;
+            try {
+                content = fs.readFileSync(path.join(ctx.cwd, rel), 'utf-8');
+            }
+            catch {
+                continue; // renamed/removed between diff and read — skip
+            }
+            const diagnostics = workspace.check(content);
+            if (diagnostics.length === 0)
+                continue;
+            filesWithIssues += 1;
+            totalIssues += diagnostics.length;
+            logger.warn(`[Ruff Lint]: ⚠️ ${rel}: ${diagnostics.length} issue(s)`);
+            diagnostics
+                .slice(0, 5)
+                .forEach((d) => logger.warn(`    ${rel}:${d.start_location.row} ${d.code ?? '?'} ${d.message}`));
+            if (diagnostics.length > 5)
+                logger.warn(`    ... and ${diagnostics.length - 5} more`);
+        }
+        if (totalIssues === 0)
+            return pass();
+        return warn(`${totalIssues} issue(s) in ${filesWithIssues} file(s)`);
+    },
+};

package/dist/esm/core/checks/languages/python-typecheck.d.ts

@@ -0,0 +1,14 @@
+import { Check } from '../../types.js';
+/**
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
+ */
+export declare const pythonTypecheckCheck: Check;

package/dist/esm/core/checks/languages/python-typecheck.js

@@ -0,0 +1,184 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { logger, resolvePackageBin } from '../../../utils/index.js';
+import { resolveTargetFiles } from '../../targets.js';
+import { pass, skip, warn } from '../../types.js';
+import { logSample } from '../findings.js';
+import { notInstalled } from '../tool-install.js';
+import { runTool } from './external-runner.js';
+import { PY_GLOBS } from './ruff-shared.js';
+/** How many diagnostics reach the log before the rest are counted instead. */
+const MAX_LOGGED = 10;
+/** The check's display name — the log prefix, and the row in the report. */
+const NAME = 'Python Types';
+/**
+ * Diagnostics that mean pyright could not see the repository's dependencies.
+ *
+ * Their presence is a verdict about the *setup*, not about the code, and the
+ * first attempt at this got it backwards: it dropped these two rules and
+ * reported everything else. That removes the cause and keeps the consequences,
+ * which is worse than either extreme — on a real client repository (ticket 076)
+ * it produced fifteen confident "type errors" of which nine were one cascade:
+ *
+ * ```python
+ * @click.group()
+ * def main() -> None: ...
+ *
+ * @main.command("list-jobs")     # nine of these
+ * def list_jobs() -> None: ...
+ * ```
+ *
+ * With `click` absent, pyright sees `main` as a plain `FunctionType` and every
+ * `@main.command(...)` becomes an error. Pyright is answering correctly; the
+ * question is wrong. The same shape follows from typer, flask, celery and pytest
+ * fixtures — most Python projects, in any CI job that does not install first.
+ *
+ * So an unresolved import means we cannot type-check at all, and the honest
+ * answer is a skip that says so. That is exactly what the TypeScript check does
+ * with a missing `node_modules`, in the same words.
+ */
+const UNRESOLVED_IMPORT_RULES = new Set(['reportMissingImports', 'reportMissingModuleSource']);
+/** How many unresolved module names the skip message names before stopping. */
+const NAMED_IMPORTS = 3;
+/** The module a `reportMissingImports` diagnostic is about, for the skip message. */
+function unresolvedModule(message) {
+    return /"([^"]+)"/.exec(message)?.[1] ?? null;
+}
+/** Whether the repository configures pyright itself. */
+function hasOwnPyrightConfig(cwd) {
+    if (fs.existsSync(path.join(cwd, 'pyrightconfig.json')))
+        return true;
+    try {
+        return fs.readFileSync(path.join(cwd, 'pyproject.toml'), 'utf-8').includes('[tool.pyright]');
+    }
+    catch {
+        return false;
+    }
+}
+/** Where our copy of pyright lives — bundled, or in a fetched profile. */
+function resolvePyright() {
+    try {
+        return resolvePackageBin('pyright', 'index.js');
+    }
+    catch {
+        return null;
+    }
+}
+/** Read mypy's text output: one diagnostic per line, with its own final count. */
+function reportMypy(output) {
+    const lines = output.split('\n').filter(line => /\berror\b|\bwarning\b/i.test(line));
+    if (lines.length === 0)
+        return pass();
+    // "Found 3 errors in 1 file (checked 12 source files)" — mypy's own count says
+    // more than a tally of lines that merely contained the word.
+    const summary = lines.find(line => /found\s+\d+\s+error/i.test(line))?.trim();
+    logSample(NAME, 'type issues (mypy):', lines);
+    return warn(summary ?? `${lines.length} type issue(s)`);
+}
+/**
+ * Type-check with our own pyright, and report only what the client can act on.
+ *
+ * Pyright is a Node bundle, so it runs through `process.execPath` rather than as
+ * a binary on the path — the same reason clang-format does.
+ */
+function reportPyright(ctx, stdout) {
+    let report;
+    try {
+        report = JSON.parse(stdout);
+    }
+    catch {
+        // Pyright exits non-zero for a bad invocation too, and calling that a type
+        // error would put a finding in the report that is really our own bug.
+        logger.warn(`[${NAME}]: ⚠️ pyright produced no readable report`);
+        return skip('pyright produced no readable report');
+    }
+    const diagnostics = (report.generalDiagnostics ?? []).filter(diagnostic => diagnostic.severity !== 'information');
+    // Nothing downstream of an unresolved import can be trusted, so this is
+    // checked before anything is reported — and skipped rather than filtered.
+    //
+    // Not applied to a repository that configures pyright itself: having written
+    // `pyrightconfig.json` (or a `[tool.pyright]` section) is having an opinion
+    // about import resolution — a `venvPath`, or these rules downgraded on
+    // purpose — and overriding it with a skip would ignore the one client who
+    // said what they wanted.
+    const unresolved = diagnostics.filter(diagnostic => UNRESOLVED_IMPORT_RULES.has(diagnostic.rule ?? ''));
+    if (unresolved.length > 0 && !hasOwnPyrightConfig(ctx.cwd)) {
+        const modules = [
+            ...new Set(unresolved
+                .map(diagnostic => unresolvedModule(diagnostic.message))
+                .filter((name) => Boolean(name))),
+        ];
+        const named = modules.slice(0, NAMED_IMPORTS).join(', ');
+        const rest = modules.length > NAMED_IMPORTS ? ` and ${modules.length - NAMED_IMPORTS} more` : '';
+        logger.warn(`[${NAME}]: ⚠️ ${unresolved.length} import(s) could not be resolved — not type-checking`);
+        return skip(`project dependencies not installed (${named || `${unresolved.length} import(s)`}${rest}) ` +
+            '— run `pip install` before typecheck');
+    }
+    if (diagnostics.length === 0) {
+        logger.info(`[${NAME}]: ✅ No type errors (pyright)`);
+        return pass();
+    }
+    const errors = diagnostics.filter(diagnostic => diagnostic.severity === 'error').length;
+    const summary = `${errors} error(s), ${diagnostics.length - errors} warning(s)`;
+    logSample(NAME, `type issues (pyright): ${summary}`, diagnostics.slice(0, MAX_LOGGED).map(diagnostic => {
+        const rel = path.relative(ctx.cwd, diagnostic.file) || diagnostic.file;
+        // Pyright counts lines from zero; every other tool in the report counts
+        // from one, and a line number that is off by one is worse than none.
+        const line = (diagnostic.range?.start?.line ?? 0) + 1;
+        return `${rel}:${line} ${diagnostic.severity}: ${diagnostic.message.split('\n')[0]}`;
+    }));
+    return warn(summary);
+}
+/**
+ * Type-checks changed Python files — the Python analogue of `tsc --noEmit`.
+ *
+ * Two checkers, and the order is the policy. **mypy first**, because a repository
+ * that installed mypy configured it too (`mypy.ini`, `[tool.mypy]`), and its
+ * settled opinion about its own code beats ours. **Our bundled pyright
+ * otherwise**, which is what stopped `⏭️ mypy/pyright not installed` from being
+ * the answer on every runner: pyright is a Node bundle carrying its own typeshed,
+ * so it needs neither Python nor pip. Force either with `python.typeChecker`.
+ *
+ * Informational by design, like Ruff lint, so teams can adopt gradually.
+ */
+export const pythonTypecheckCheck = {
+    name: NAME,
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.python?.enabled !== false &&
+            ctx.config.python?.typecheck !== false &&
+            ctx.languages.includes('python'));
+    },
+    async run(ctx) {
+        const targets = await resolveTargetFiles(ctx, PY_GLOBS);
+        if (targets === null)
+            return skip('git unavailable');
+        if (targets.length === 0)
+            return pass('no Python files changed');
+        const forced = ctx.config.python?.typeChecker;
+        if (forced !== 'pyright') {
+            const mypy = await runTool(ctx, 'mypy', targets);
+            if (!mypy.missing) {
+                if (mypy.exitCode === 0) {
+                    logger.info(`[${NAME}]: ✅ No type errors (mypy)`);
+                    return pass();
+                }
+                return reportMypy([mypy.stdout, mypy.stderr].filter(Boolean).join('\n'));
+            }
+            // Asking for mypy by name and not having it is a configuration error the
+            // client meant to make visible; falling back to pyright would hide it.
+            if (forced === 'mypy')
+                return notInstalled('mypy', 'mypy');
+        }
+        const entry = resolvePyright();
+        if (!entry)
+            return notInstalled('pyright', 'pyright');
+        const result = await runTool(ctx, process.execPath, [entry, '--outputjson', ...targets]);
+        // The binary here is the Node running this process, so `missing` is not a
+        // reachable state — it is a case of the type, folded in rather than asserted
+        // away.
+        if (result.missing)
+            return notInstalled('pyright', 'pyright');
+        return reportPyright(ctx, result.stdout);
+    },
+};

package/dist/esm/core/checks/languages/ruff-shared.d.ts

@@ -0,0 +1,10 @@
+type RuffModule = typeof import('@astral-sh/ruff-wasm-nodejs');
+type RuffWorkspace = InstanceType<RuffModule['Workspace']>;
+export declare const PY_GLOBS: string[];
+/**
+ * Instantiate a Ruff WASM workspace. Shared by the Ruff lint and format checks so
+ * their setup stays identical, and kept as a function (not a module-level
+ * singleton) so the WASM module loads only when a check runs.
+ */
+export declare function createRuffWorkspace(): RuffWorkspace;
+export {};

package/dist/esm/core/checks/languages/ruff-shared.js

@@ -0,0 +1,35 @@
+import { createRequire as __createRequire } from 'node:module';
+const require = __createRequire(import.meta.url);
+export const PY_GLOBS = ['*.py'];
+/**
+ * The rules we lint Python with — pinned here rather than left to Ruff's defaults.
+ *
+ * `E4`/`E7`/`E9` (import placement, statement style, syntax) plus `F` (pyflakes:
+ * undefined names, unused imports, unreachable code) — the set Ruff itself
+ * shipped as its default through 0.15.
+ *
+ * Written down because leaving it implicit made our verdict change under us.
+ * Ruff 0.16 added the isort rules (`I`) to its defaults, and a routine dependency
+ * bump turned that into a 5- to 48-fold increase in findings across seventeen
+ * Python repositories — every one of them `I001`, "import block is un-sorted".
+ * Two repositories went from a clean report to a warning on code nobody had
+ * touched. Import order is a matter of taste, and a check that fires on every
+ * file in a repository is how people learn to ignore the whole report.
+ *
+ * Adding a rule to this list is a decision with a measurement behind it, which
+ * is the point: it is ours to make, not our dependency's to make for us.
+ */
+const SELECTED_RULES = ['E4', 'E7', 'E9', 'F'];
+/**
+ * Instantiate a Ruff WASM workspace. Shared by the Ruff lint and format checks so
+ * their setup stays identical, and kept as a function (not a module-level
+ * singleton) so the WASM module loads only when a check runs.
+ */
+export function createRuffWorkspace() {
+    const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+    const settings = {
+        ...Workspace.defaultSettings(),
+        lint: { select: SELECTED_RULES },
+    };
+    return new Workspace(settings, PositionEncoding.Utf16);
+}

package/dist/esm/core/checks/languages/typecheck.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const typecheckCheck: Check;

package/dist/esm/core/checks/languages/typecheck.js

@@ -0,0 +1,61 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execa } from '../../../utils/execa.js';
+import { logger, resolvePackageBin } from '../../../utils/index.js';
+import { clientToolPaths } from '../../install/reuse.js';
+import { pass, fail, warn, skip } from '../../types.js';
+/**
+ * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the
+ * version it was written for; fall back to the compiler bundled with pr-checkmate.
+ */
+function resolveTsc(ctx) {
+    // `clientOwnsConfig` unconditionally: this check does not apply without a
+    // `tsconfig.json` in the repository, so the compiler their config was written
+    // for is always theirs. `install.reuseLocal: "off"` still overrides, for a
+    // client who wants our pinned compiler for reproducibility.
+    return resolvePackageBin('typescript', 'bin/tsc', {
+        paths: clientToolPaths('typescript', ctx, { clientOwnsConfig: true }),
+    });
+}
+export const typecheckCheck = {
+    name: 'TypeScript',
+    phase: 'blocking',
+    weight: 'heavy',
+    applies(ctx) {
+        if (ctx.config.typecheck?.enabled === false)
+            return false;
+        if (!ctx.languages.includes('typescript'))
+            return false;
+        return fs.existsSync(path.join(ctx.cwd, 'tsconfig.json'));
+    },
+    async run(ctx) {
+        // tsc needs the project's installed type declarations — everything listed in
+        // tsconfig's `types`, plus every imported @types package — to resolve. When the
+        // project's dependencies aren't installed (e.g. a CI step that runs pr-checkmate
+        // via npx without a prior `npm ci`), tsc emits a wall of cryptic TS2688
+        // "cannot find type definition file" errors that look like code problems but are
+        // really a setup gap. Skip with an actionable message instead of failing the PR.
+        if (!fs.existsSync(path.join(ctx.cwd, 'node_modules'))) {
+            return skip('project dependencies not installed (no node_modules) — run `npm ci` before typecheck');
+        }
+        const tscBin = resolveTsc(ctx);
+        const result = await execa(process.execPath, [tscBin, '--noEmit'], {
+            cwd: ctx.cwd,
+            reject: false,
+        });
+        if (result.exitCode === 0)
+            return pass();
+        const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
+        const errorCount = (output.match(/error TS\d+/g) ?? []).length;
+        if (output)
+            logger.warn(output);
+        // A non-zero exit with no diagnostic in it is not a type error — tsc was
+        // killed (OOM on a large project), crashed, or never started. Reporting that
+        // as `0 type error(s)` blocked PRs with a message naming nothing to fix.
+        if (errorCount === 0) {
+            logger.warn(`[TypeScript]: ⚠️ tsc exited ${result.exitCode ?? 'abnormally'} without reporting a type error — treating as a tooling failure, not a type error`);
+            return warn(`tsc failed to run (exit ${result.exitCode ?? 'killed'})`);
+        }
+        return fail(`${errorCount} type error(s)`);
+    },
+};

package/dist/esm/core/checks/pr/commitlint.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const commitlintCheck: Check;

package/dist/esm/core/checks/pr/commitlint.js

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { hasLocalConfig } from '../../../config/index.js';
+import { execa } from '../../../utils/execa.js';
+import { logger, resolveGitRef, resolvePackageBin } from '../../../utils/index.js';
+import { pass, skip, warn } from '../../types.js';
+const LOCAL_CONFIG_FILES = [
+    'commitlint.config.cjs',
+    'commitlint.config.js',
+    'commitlint.config.mjs',
+    'commitlint.config.ts',
+    '.commitlintrc',
+    '.commitlintrc.json',
+    '.commitlintrc.yaml',
+    '.commitlintrc.yml',
+    '.commitlintrc.js',
+    '.commitlintrc.cjs',
+];
+const DEFAULT_TYPES = [
+    'feat',
+    'fix',
+    'docs',
+    'chore',
+    'ci',
+    'refactor',
+    'perf',
+    'style',
+    'revert',
+    'test',
+    'build',
+];
+const DEFAULT_IGNORES = ['^Release\\b', '^chore\\(release\\):'];
+function buildTempConfig(types, ignores) {
+    // Emit a CJS module so `ignores` can hold functions — commitlint requires
+    // predicate functions there, which a JSON config cannot express.
+    // Resolve config-conventional via Node module resolution — robust to hoisting.
+    const configConventional = require.resolve('@commitlint/config-conventional');
+    const content = `const patterns = ${JSON.stringify(ignores)}.map((p) => new RegExp(p, 'i'));
+module.exports = {
+  extends: [${JSON.stringify(configConventional)}],
+  rules: { 'type-enum': [2, 'always', ${JSON.stringify(types)}] },
+  ignores: [(commit) => patterns.some((re) => re.test(commit))],
+};
+`;
+    const tmpFile = path.join(os.tmpdir(), `.commitlint-${process.pid}.cjs`);
+    fs.writeFileSync(tmpFile, content);
+    return tmpFile;
+}
+export const commitlintCheck = {
+    name: 'Commitlint',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.commitlint?.enabled !== false;
+    },
+    async run(ctx) {
+        // This check needs a commit to lint. Without a repository `--last` finds
+        // none, commitlint prints nothing and exits 0, and we reported `pass` — a
+        // verdict on a commit message that does not exist. Ticket 072: a check that
+        // examined nothing must not read as a check that found nothing.
+        if (!(await resolveGitRef(ctx.cwd, 'HEAD')))
+            return skip('git unavailable');
+        const commitlintBin = resolvePackageBin('@commitlint/cli', 'cli.js');
+        const hasLocal = hasLocalConfig(LOCAL_CONFIG_FILES, ctx.cwd);
+        let tempConfigFile = null;
+        // With no diff range (a full-repo review, or `--full`) the check still has a
+        // meaningful subject: the newest commit message. `HEAD~1` cannot be assumed to
+        // exist, though — it is absent on a repository's first commit and in a shallow
+        // clone (`actions/checkout` fetches depth 1 by default). Passing it blind made
+        // commitlint die with an unhandled "ambiguous argument 'HEAD~1..HEAD'" stack
+        // trace in the client's log, and the check then reported "commit message
+        // violations found" — a verdict about code quality for what was a crash.
+        // `--last` lints exactly the newest commit and needs no ancestor.
+        const range = ctx.baseSha
+            ? ['--from', ctx.baseSha, '--to', ctx.headSha ?? 'HEAD']
+            : (await resolveGitRef(ctx.cwd, 'HEAD~1'))
+                ? ['--from', 'HEAD~1', '--to', ctx.headSha ?? 'HEAD']
+                : ['--last'];
+        const args = [...range, '--verbose'];
+        try {
+            if (hasLocal) {
+                logger.info('[Commitlint]: Using local config');
+            }
+            else {
+                const types = ctx.config.commitlint?.types ?? DEFAULT_TYPES;
+                const ignores = ctx.config.commitlint?.ignores ?? DEFAULT_IGNORES;
+                tempConfigFile = buildTempConfig(types, ignores);
+                args.push('--config', tempConfigFile);
+            }
+            const result = await execa(process.execPath, [commitlintBin, ...args], {
+                cwd: ctx.cwd,
+                reject: false,
+                stdio: 'inherit',
+            });
+            return result.exitCode === 0 ? pass() : warn('commit message violations found');
+        }
+        finally {
+            if (tempConfigFile && fs.existsSync(tempConfigFile))
+                fs.unlinkSync(tempConfigFile);
+        }
+    },
+};

package/dist/esm/core/checks/pr/pr-body.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const prBodyCheck: Check;

package/dist/esm/core/checks/pr/pr-body.js

@@ -0,0 +1,43 @@
+import fs from 'node:fs';
+import { logger } from '../../../utils/index.js';
+import { pass, warn, skip } from '../../types.js';
+// Matches "Closes #123", "Fixes #45", "Resolves #7" or JIRA-style "PROJ-456".
+const TICKET_PATTERN = /(?:closes?|fixes?|resolves?)\s+#\d+|[A-Z][A-Z0-9]+-\d+/i;
+export const prBodyCheck = {
+    name: 'PR Body',
+    phase: 'informational',
+    applies(ctx) {
+        if (ctx.config.prBody?.enabled === false)
+            return false;
+        const eventPath = process.env.GITHUB_EVENT_PATH;
+        return Boolean(eventPath && fs.existsSync(eventPath));
+    },
+    async run(ctx) {
+        const minLength = ctx.config.prBody?.minLength ?? 20;
+        const requireTicket = ctx.config.prBody?.requireTicket ?? true;
+        let event;
+        try {
+            event = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf-8'));
+        }
+        catch (err) {
+            logger.warn(`[PR Body]: ⚠️ Could not read GitHub event\n${err}`);
+            return skip('event unreadable');
+        }
+        const pr = event.pull_request;
+        if (!pr)
+            return skip('no PR data');
+        const trimmed = (pr.body ?? '').trim();
+        const issues = [];
+        if (trimmed.length < minLength) {
+            issues.push(`description too short (${trimmed.length}/${minLength} chars min)`);
+        }
+        if (requireTicket && trimmed && !TICKET_PATTERN.test(trimmed)) {
+            issues.push('no ticket reference (e.g. "Closes #123" or "PROJ-456")');
+        }
+        if (issues.length > 0) {
+            issues.forEach(i => logger.warn(`[PR Body]: ⚠️ ${i}`));
+            return warn(issues.join('; '));
+        }
+        return pass();
+    },
+};

package/dist/esm/core/checks/pr/pr-size-check.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const prSizeCheck: Check;

package/dist/esm/core/checks/pr/pr-size-check.js

@@ -0,0 +1,42 @@
+import { execa } from '../../../utils/execa.js';
+import { logger } from '../../../utils/index.js';
+import { pass, warn, skip } from '../../types.js';
+const DEFAULT_MAX_FILES = 50;
+const DEFAULT_MAX_LINES = 1000;
+export const prSizeCheck = {
+    name: 'PR Size',
+    phase: 'informational',
+    requiresDiff: true,
+    applies(ctx) {
+        return ctx.config.prSize?.enabled !== false;
+    },
+    async run(ctx) {
+        const maxFiles = ctx.config.prSize?.maxFiles ?? DEFAULT_MAX_FILES;
+        const maxLines = ctx.config.prSize?.maxLines ?? DEFAULT_MAX_LINES;
+        try {
+            const { stdout } = await execa('git', ['diff', '--shortstat', ctx.baseSha, ctx.headSha ?? 'HEAD'], {
+                cwd: ctx.cwd,
+            });
+            // "5 files changed, 123 insertions(+), 45 deletions(-)"
+            const fileCount = parseInt(stdout.match(/(\d+) files? changed/)?.[1] ?? '0', 10);
+            const insertions = parseInt(stdout.match(/(\d+) insertion/)?.[1] ?? '0', 10);
+            const deletions = parseInt(stdout.match(/(\d+) deletion/)?.[1] ?? '0', 10);
+            const lines = insertions + deletions;
+            logger.info(`[PR Size]: ${fileCount} files changed, ${lines} lines`);
+            const issues = [];
+            if (fileCount > maxFiles)
+                issues.push(`${fileCount} files (recommended < ${maxFiles})`);
+            if (lines > maxLines)
+                issues.push(`${lines} lines (recommended < ${maxLines})`);
+            if (issues.length > 0) {
+                issues.forEach(i => logger.warn(`[PR Size]: ⚠️ Large PR: ${i}`));
+                return warn(issues.join(', '));
+            }
+            return pass();
+        }
+        catch (err) {
+            logger.warn(`[PR Size]: ⚠️ Could not measure PR size\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/pr/pr-title-lint.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const prTitleLintCheck: Check;

package/dist/esm/core/checks/pr/pr-title-lint.js

@@ -0,0 +1,31 @@
+import fs from 'node:fs';
+import { logger } from '../../../utils/index.js';
+import { pass, warn, skip } from '../../types.js';
+const CONVENTIONAL_PREFIX = /^(feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert)(\(.+\))?!?: .+/;
+export const prTitleLintCheck = {
+    name: 'PR Title',
+    phase: 'informational',
+    applies() {
+        const eventPath = process.env.GITHUB_EVENT_PATH;
+        return Boolean(eventPath && fs.existsSync(eventPath));
+    },
+    async run() {
+        let event;
+        try {
+            event = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf-8'));
+        }
+        catch (err) {
+            logger.warn(`[PR Title]: ⚠️ Could not read GitHub event\n${err}`);
+            return skip('event unreadable');
+        }
+        const pr = event.pull_request;
+        if (!pr?.title)
+            return skip('no PR title');
+        const title = pr.title;
+        if (!CONVENTIONAL_PREFIX.test(title)) {
+            logger.warn(`[PR Title]: ⚠️ Not Conventional Commits: "${title}"`);
+            return warn('title does not follow Conventional Commits');
+        }
+        return pass();
+    },
+};

package/dist/esm/core/checks/quality/case-collision.d.ts

@@ -0,0 +1,8 @@
+import { Check } from '../../types.js';
+/**
+ * Flags tracked files whose paths differ only by case (e.g. `Foo.ts` vs
+ * `foo.ts`). Such pairs coexist on Linux (case-sensitive) but collide on macOS/
+ * Windows and in many Docker layers, silently breaking checkouts and builds.
+ * Whole-repo scan (not delta), scoped to `sourcePath` and honouring `ignoreDirs`.
+ */
+export declare const caseCollisionCheck: Check;