pr-checkmate 3.0.4 → 3.2.0

package/dist/esm/core/checks/dependencies/circular-deps.js

@@ -0,0 +1,155 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { getSourcePaths } from '../../../config/index.js';
+import { execa } from '../../../utils/execa.js';
+import { cleanupTempFile, logger, matchesAnyGlob, resolvePackageBin, } from '../../../utils/index.js';
+import { clientToolPaths } from '../../install/reuse.js';
+import { listTrackedFiles } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { severityEmitter } from '../findings.js';
+/**
+ * Cap for the analysis. dpdm builds the whole module graph, which on a large repo
+ * is the slowest part of a run — an uncapped analysis looks like a hung commit.
+ */
+const DEFAULT_TIMEOUT_MS = 120000;
+/**
+ * Ceiling for the assembled argument list. Passing every tracked source file as a
+ * separate argument overflows the OS argument limit (`E2BIG`) on a large repo, and
+ * a spawn that never starts writes no report. Past the ceiling dpdm gets globs
+ * instead — it expands them itself, over the same source paths.
+ */
+const MAX_ARGV_CHARS = 100000;
+/** Extensions dpdm resolves for us; also the globs used in the fallback. */
+const SOURCE_GLOBS = ['*.ts', '*.tsx', '*.js', '*.jsx'];
+/**
+ * Resolve dpdm, preferring the consumer project's own copy (so a repo pinned to a
+ * different major keeps its own behaviour) and falling back to the copy bundled
+ * with pr-checkmate — the order `lint` and `typecheck` use for eslint/tsc.
+ *
+ * Returns null instead of throwing: an unresolvable analyzer is a skip, never a
+ * failed PR. This check used to shell out to `npx dpdm`, which silently fetched
+ * dpdm from the registry on first use — and when that fetch could not happen
+ * (offline or locked-down CI, private registry, exit 127) nothing was analyzed.
+ */
+function resolveDpdm(ctx) {
+    // No configuration of its own — dpdm reads the module graph — so the version
+    // check is the right question here and `clientOwnsConfig` stays off.
+    for (const options of [{ paths: clientToolPaths('dpdm', ctx) }, undefined]) {
+        try {
+            return resolvePackageBin('dpdm', 'lib/bin/dpdm.js', options);
+        }
+        catch {
+            // Try the next location; both failing is a skip, handled by the caller.
+        }
+    }
+    return null;
+}
+/**
+ * Build the file arguments for dpdm, falling back to globs when the explicit list
+ * would overflow the OS argument limit. `sourcePaths` scopes the globs the same way
+ * `listTrackedFiles` scopes the explicit list.
+ */
+function toFileArgs(files, sourcePaths) {
+    const explicitLength = files.reduce((sum, file) => sum + file.length + 1, 0);
+    if (explicitLength <= MAX_ARGV_CHARS)
+        return files;
+    const roots = sourcePaths.length > 0 ? sourcePaths : ['.'];
+    const globs = roots.flatMap(root => SOURCE_GLOBS.map(ext => `${root.replace(/\/+$/, '')}/**/${ext}`));
+    logger.info(`[Circular Deps]: ${files.length} files exceed the argument limit — analyzing via globs (${globs.join(', ')})`);
+    return globs;
+}
+/** Read dpdm's report file; null when it is absent or unparseable. */
+function readReport(reportPath) {
+    try {
+        return JSON.parse(fs.readFileSync(reportPath, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export const circularDepsCheck = {
+    name: 'Circular Deps',
+    phase: 'blocking',
+    weight: 'heavy',
+    applies(ctx) {
+        if (ctx.config.circularDeps?.enabled === false)
+            return false;
+        return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
+    },
+    async run(ctx) {
+        const allFiles = await listTrackedFiles(ctx, SOURCE_GLOBS, getSourcePaths(ctx.cwd));
+        // A cycle detector needs the WHOLE graph, so an unreadable file list is the
+        // one case where passing would be worst: half a graph produces confident
+        // nonsense, and no graph reported as `pass` says the repository is acyclic
+        // when nobody looked (ticket 072).
+        if (allFiles === null)
+            return skip('git unavailable');
+        if (allFiles.length === 0)
+            return pass();
+        // Files the client exempted (generated code, vendored bundles) are dropped
+        // before analysis — and again from the cycles below, since the graph can reach
+        // an ignored file by following imports from one that is analyzed.
+        const ignore = ctx.config.circularDeps?.ignore ?? [];
+        const files = ignore.length > 0 ? allFiles.filter(f => !matchesAnyGlob(f, ignore)) : allFiles;
+        if (files.length === 0)
+            return skip('all files ignored');
+        const dpdmBin = resolveDpdm(ctx);
+        if (!dpdmBin) {
+            logger.warn('[Circular Deps]: ⚠️ dpdm could not be resolved — skipping');
+            return skip('dpdm unavailable');
+        }
+        const timeout = ctx.config.circularDeps?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const reportPath = path.join(ctx.cwd, '.dpdm.temp.json');
+        try {
+            // Read the cycles from dpdm's JSON report rather than its console output.
+            // The console shapes this check used to grep for ("Circular Dependencies:",
+            // "[1] a -> b") are not what dpdm 4 prints ("• Circular Dependencies",
+            // "1) a -> b"), so no cycle ever matched and the check passed every repo,
+            // including one built solely out of a cycle. `--exit-code circular:1` gives
+            // the same answer independently: dpdm otherwise exits 0 even when it finds
+            // cycles, so the exit code alone cannot tell a clean repo from a broken run.
+            const result = await execa(process.execPath, [
+                dpdmBin,
+                '--no-warning',
+                '--no-tree',
+                '--no-circular',
+                '--exit-code',
+                'circular:1',
+                '-o',
+                reportPath,
+                ...toFileArgs(files, getSourcePaths(ctx.cwd)),
+            ], { cwd: ctx.cwd, reject: false, timeout });
+            if (result.timedOut) {
+                logger.warn(`[Circular Deps]: ⚠️ dpdm timed out after ${timeout}ms — skipping`);
+                return skip('dpdm timed out');
+            }
+            const report = readReport(reportPath);
+            // No report means dpdm never got far enough to write one (a tsconfig it
+            // cannot read, a file it cannot parse, a killed process). Skip: reporting
+            // that as "no cycles" hides a check that did not run, and failing on it
+            // blocks a PR that may have no cycle at all.
+            if (!report) {
+                const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
+                logger.warn(`[Circular Deps]: ⚠️ dpdm wrote no report (exit ${result.exitCode ?? 'killed'})${output ? `:\n${output}` : ''}`);
+                return skip(`dpdm failed to run (exit ${result.exitCode ?? 'killed'})`);
+            }
+            const cycles = (report.circulars ?? []).filter(cycle => ignore.length === 0 || !cycle.some(file => matchesAnyGlob(file, ignore)));
+            if (cycles.length === 0)
+                return pass();
+            // Advisory by default. This check reported nothing for its whole existence
+            // (see the note above), so switching it on turns every long-standing cycle
+            // in every client repo into a finding at once — barrel files alone account
+            // for most of them. Warning first lets a repo see its cycles before they
+            // gate anything; promote with `circularDeps.severity: "error"`.
+            const sev = severityEmitter(ctx.config.circularDeps?.severity, 'warn');
+            sev.log(`[Circular Deps]: ${sev.icon} ${cycles.length} circular dependency(ies):`);
+            cycles.slice(0, 10).forEach((cycle, i) => sev.log(`  ${i + 1}) ${cycle.join(' -> ')}`));
+            if (cycles.length > 10)
+                sev.log(`  ... and ${cycles.length - 10} more`);
+            return sev.emit(`${cycles.length} circular dependency(ies) found`);
+        }
+        finally {
+            cleanupTempFile(reportPath);
+        }
+    },
+};

package/dist/esm/core/checks/dependencies/dependency-check.d.ts

@@ -0,0 +1,43 @@
+import { Check } from '../../types.js';
+/** One entry of knip's JSON reporter — a file plus the issues found for it. */
+interface KnipIssue {
+    file: string;
+    dependencies?: {
+        name: string;
+    }[];
+    unlisted?: {
+        name: string;
+    }[];
+}
+interface KnipReport {
+    issues?: KnipIssue[];
+}
+/**
+ * Compile one `dependency.ignore` entry into a pattern knip matches the way this
+ * config documents it — a glob over the whole dependency name.
+ *
+ * knip turns any value containing `* + \ ( | { ^ $` into an *unanchored* `RegExp`
+ * and compares everything else by string equality. A glob passed straight through
+ * would therefore silence far more than it names: `eslint-*` reads as "eslint
+ * followed by zero or more dashes", tested as a substring, so it also swallows
+ * `eslint` itself. Escaping first and anchoring the result keeps `eslint-*` matching
+ * only `eslint-…`, and keeps a plain name matching exactly that name.
+ */
+export declare function toKnipIgnorePattern(entry: string): string;
+/**
+ * Pull knip's report out of a stdout stream that may carry unrelated output.
+ *
+ * knip imports the project's own config files while analyzing (a `wdio.conf.ts`
+ * for its WebdriverIO plugin, say), so any top-level side effect in them —
+ * a dotenv banner, a `console.log` in a config module — is printed before the
+ * report. Slicing from the first `{` to the last `}` therefore captured that
+ * noise instead: a dotenvx tip ending in `{ path: '…/.env' }` made the whole
+ * check fail on a repo whose report was perfectly valid.
+ *
+ * The json reporter writes the report as a single line (`JSON.stringify` with no
+ * indentation), so the last line that parses AND carries `issues` is the report.
+ * Anything else on stdout is noise, whatever braces it happens to contain.
+ */
+export declare function parseKnipReport(stdout: string): KnipReport | null;
+export declare const dependencyCheck: Check;
+export {};

package/dist/esm/core/checks/dependencies/dependency-check.js

@@ -0,0 +1,174 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { hasLocalConfig } from '../../../config/index.js';
+import { execa } from '../../../utils/execa.js';
+import { logger, cleanupTempFile, resolvePackageBin } from '../../../utils/index.js';
+import { isNpmProject, pass, fail, warn, skip } from '../../types.js';
+/**
+ * Config files knip discovers on its own. When a client ships one, it is the source
+ * of truth and pr-checkmate passes no config of its own — the same rule spellcheck
+ * follows for cspell.json.
+ *
+ * Mirrors knip's own `KNIP_CONFIG_LOCATIONS` exactly. Listing a name knip does not
+ * read (`knip.config.mjs`, say) would be worse than useless: the repo would count as
+ * "configures knip itself", so `dependency.ignore` would be dropped, while knip
+ * ignored that file too — leaving the client with warnings they had silenced.
+ */
+const KNIP_CONFIG_FILES = [
+    'knip.json',
+    'knip.jsonc',
+    '.knip.json',
+    '.knip.jsonc',
+    'knip.ts',
+    'knip.js',
+    'knip.config.ts',
+    'knip.config.js',
+];
+/** Regex metacharacters to neutralise before a glob is compiled. */
+const REGEX_SPECIALS = /[.*+?^${}()|[\]\\]/g;
+/**
+ * Compile one `dependency.ignore` entry into a pattern knip matches the way this
+ * config documents it — a glob over the whole dependency name.
+ *
+ * knip turns any value containing `* + \ ( | { ^ $` into an *unanchored* `RegExp`
+ * and compares everything else by string equality. A glob passed straight through
+ * would therefore silence far more than it names: `eslint-*` reads as "eslint
+ * followed by zero or more dashes", tested as a substring, so it also swallows
+ * `eslint` itself. Escaping first and anchoring the result keeps `eslint-*` matching
+ * only `eslint-…`, and keeps a plain name matching exactly that name.
+ */
+export function toKnipIgnorePattern(entry) {
+    const escaped = entry.replace(REGEX_SPECIALS, '\\$&');
+    return `^${escaped.replace(/\\\*/g, '.*').replace(/\\\?/g, '.')}$`;
+}
+/** knip also reads a `knip` key from package.json. */
+function hasPackageJsonConfig(cwd) {
+    try {
+        return 'knip' in JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Pull knip's report out of a stdout stream that may carry unrelated output.
+ *
+ * knip imports the project's own config files while analyzing (a `wdio.conf.ts`
+ * for its WebdriverIO plugin, say), so any top-level side effect in them —
+ * a dotenv banner, a `console.log` in a config module — is printed before the
+ * report. Slicing from the first `{` to the last `}` therefore captured that
+ * noise instead: a dotenvx tip ending in `{ path: '…/.env' }` made the whole
+ * check fail on a repo whose report was perfectly valid.
+ *
+ * The json reporter writes the report as a single line (`JSON.stringify` with no
+ * indentation), so the last line that parses AND carries `issues` is the report.
+ * Anything else on stdout is noise, whatever braces it happens to contain.
+ */
+export function parseKnipReport(stdout) {
+    const lines = stdout.split('\n');
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i].trim();
+        if (!line.startsWith('{'))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            if (Array.isArray(parsed.issues))
+                return parsed;
+        }
+        catch {
+            // A noise line that merely looks like JSON — keep scanning upwards.
+        }
+    }
+    return null;
+}
+/** Collect the names reported for one issue type across every file in the report. */
+function collectNames(issues, key) {
+    return [...new Set(issues.flatMap(issue => (issue[key] ?? []).map(entry => entry.name)))];
+}
+/** Files a given unlisted dependency is imported from, for the failure message. */
+function filesUsing(issues, name) {
+    return issues
+        .filter(issue => (issue.unlisted ?? []).some(entry => entry.name === name))
+        .map(issue => issue.file);
+}
+export const dependencyCheck = {
+    name: 'Dependencies',
+    phase: 'blocking',
+    weight: 'heavy',
+    applies(ctx) {
+        if (ctx.config.dependency?.enabled === false)
+            return false;
+        return isNpmProject(ctx);
+    },
+    async run(ctx) {
+        // Resolve the bundled knip binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when knip isn't on the path.
+        let knipBin;
+        try {
+            knipBin = resolvePackageBin('knip', 'bin/knip.js');
+        }
+        catch {
+            return skip('knip unavailable');
+        }
+        // Dependency names to skip, configured in pr-checkmate.json. knip takes these
+        // from a config file only, so they go into a temp one — but a client's own knip
+        // config wins outright, exactly as it does for cspell.
+        const ignore = ctx.config.dependency?.ignore ?? [];
+        const clientOwnsConfig = hasLocalConfig(KNIP_CONFIG_FILES, ctx.cwd) || hasPackageJsonConfig(ctx.cwd);
+        let tempConfigPath = null;
+        if (ignore.length > 0 && clientOwnsConfig) {
+            // Say so out loud: a silently ignored `ignore` list looks like a broken check.
+            logger.info(`[Dependencies]: ℹ️ this repo has its own knip config, so dependency.ignore (${ignore.join(', ')}) is not applied — add those names to knip's ignoreDependencies instead.`);
+        }
+        if (ignore.length > 0 && !clientOwnsConfig) {
+            tempConfigPath = path.join(ctx.cwd, '.knip.temp.json');
+            fs.writeFileSync(tempConfigPath, JSON.stringify({ ignoreDependencies: ignore.map(toKnipIgnorePattern) }, null, 2));
+        }
+        // Only unused prod dependencies and imports missing from package.json are
+        // reported. knip's other issue types (unused devDependencies, binaries,
+        // unresolved paths) are noise here: CLI tools and shell commands legitimately
+        // have no import to find.
+        const args = [
+            knipBin,
+            '--reporter',
+            'json',
+            '--include',
+            'dependencies,unlisted',
+            '--no-config-hints',
+            '--no-exit-code',
+            '--no-progress',
+        ];
+        if (tempConfigPath)
+            args.push('--config', tempConfigPath);
+        try {
+            // reject:false — knip can still exit non-zero (e.g. config hints) while
+            // writing a perfectly good report to stdout.
+            const { stdout } = await execa(process.execPath, args, {
+                cwd: ctx.cwd,
+                reject: false,
+            });
+            const result = parseKnipReport(stdout);
+            // No report on stdout → the tool couldn't produce a result; skip rather than
+            // fail the client's PR. Never fail here: a check that blocks a PR because a
+            // tool misbehaved reports our problem as the client's.
+            if (!result)
+                return skip('knip produced no report');
+            const issues = result.issues ?? [];
+            const unused = collectNames(issues, 'dependencies');
+            const missing = collectNames(issues, 'unlisted');
+            if (missing.length > 0) {
+                missing.forEach(dep => logger.error(`[Dependencies]: ❌ missing ${dep} (used in: ${filesUsing(issues, dep).join(', ')})`));
+                return fail(`missing: ${missing.join(', ')}`);
+            }
+            if (unused.length > 0) {
+                unused.forEach(dep => logger.warn(`[Dependencies]: ⚠️ unused ${dep}`));
+                return warn(`${unused.length} unused dependency(ies)`);
+            }
+            return pass();
+        }
+        finally {
+            if (tempConfigPath)
+                cleanupTempFile(tempConfigPath);
+        }
+    },
+};

package/dist/esm/core/checks/dependencies/grype-scan.d.ts

@@ -0,0 +1,22 @@
+import { Check } from '../../types.js';
+/**
+ * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
+ * default — runs unless `grypeScan.enabled` is explicitly `false`. grype is a
+ * runner-dependency: it must be on the runner, and the check skips gracefully
+ * (not fails) when it is absent.
+ *
+ * grype resolves versions from lockfiles, so its raw output includes the entire
+ * transitive tree — and, because pr-checkmate installs into the consumer's
+ * node_modules, its own bundled dependencies too. Neither is something the
+ * consumer can fix. We therefore report ONLY vulnerabilities in DIRECT
+ * dependencies (those declared in the project's manifests, see
+ * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
+ * ecosystem has no manifest we can parse are suppressed too, and the count of
+ * everything dropped is logged so nothing is hidden silently.
+ *
+ * The scan is confined to the project's own files: `ignoreDirs` is passed to grype
+ * as `--exclude`, and a timeout backstops the run. Both matter — cataloguing an
+ * installed `node_modules` is minutes of work whose every finding this check then
+ * throws away as third-party.
+ */
+export declare const grypeScanCheck: Check;

package/dist/esm/core/checks/dependencies/grype-scan.js

@@ -0,0 +1,112 @@
+import { execa } from '../../../utils/execa.js';
+import { collectDirectDeps, logger, normalizeName } from '../../../utils/index.js';
+import { pass, skip, warn } from '../../types.js';
+import { notInstalled } from '../tool-install.js';
+const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
+/** grype artifact `type` → the ecosystem we can resolve direct deps for. */
+const TYPE_TO_ECOSYSTEM = {
+    npm: 'npm',
+    python: 'python',
+    'go-module': 'go',
+    'rust-crate': 'rust',
+    gem: 'ruby',
+    'php-composer': 'php',
+};
+/**
+ * Cap for the scan. grype has no internal limit, so without this a slow scan just
+ * looks like a hung commit — an advisory check must never be able to do that.
+ */
+const DEFAULT_TIMEOUT_MS = 120000;
+function severityRank(severity) {
+    return SEVERITY_ORDER.indexOf((severity ?? '').toLowerCase());
+}
+/**
+ * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
+ * default — runs unless `grypeScan.enabled` is explicitly `false`. grype is a
+ * runner-dependency: it must be on the runner, and the check skips gracefully
+ * (not fails) when it is absent.
+ *
+ * grype resolves versions from lockfiles, so its raw output includes the entire
+ * transitive tree — and, because pr-checkmate installs into the consumer's
+ * node_modules, its own bundled dependencies too. Neither is something the
+ * consumer can fix. We therefore report ONLY vulnerabilities in DIRECT
+ * dependencies (those declared in the project's manifests, see
+ * `collectDirectDeps`): the set the maintainer actually controls. Findings whose
+ * ecosystem has no manifest we can parse are suppressed too, and the count of
+ * everything dropped is logged so nothing is hidden silently.
+ *
+ * The scan is confined to the project's own files: `ignoreDirs` is passed to grype
+ * as `--exclude`, and a timeout backstops the run. Both matter — cataloguing an
+ * installed `node_modules` is minutes of work whose every finding this check then
+ * throws away as third-party.
+ */
+export const grypeScanCheck = {
+    name: 'Grype Scan',
+    phase: 'informational',
+    weight: 'heavy',
+    applies(ctx) {
+        return ctx.config.grypeScan?.enabled !== false;
+    },
+    async run(ctx) {
+        const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
+        const minRank = severityRank(minSeverity);
+        const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
+        // Never walk `ignoreDirs` — the same contract every other check honours, and
+        // here it is the difference between a usable check and an unusable one. A bare
+        // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
+        // 355s versus 0.8s with the directory excluded, for byte-for-byte the same
+        // findings: grype resolves package versions from the lockfile, and installed
+        // third-party code is not something the client could fix anyway (see below).
+        const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
+        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const result = await execa('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
+            cwd: ctx.cwd,
+            reject: false,
+            timeout,
+        });
+        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
+        // when the binary is absent — detect the missing scanner on the result.
+        if (result.code === 'ENOENT')
+            return notInstalled('grype');
+        if (result.timedOut) {
+            logger.warn(`[Grype Scan]: ⚠️ grype timed out after ${timeout}ms — skipping`);
+            return skip('grype timed out');
+        }
+        let report;
+        try {
+            report = JSON.parse(result.stdout);
+        }
+        catch {
+            return warn('grype produced no parseable output');
+        }
+        const matches = report.matches ?? [];
+        const direct = collectDirectDeps(ctx.cwd);
+        // Keep only: severity >= threshold, a direct dependency, and not ignored.
+        const isDirect = (m) => {
+            const ecosystem = TYPE_TO_ECOSYSTEM[m.artifact?.type ?? ''];
+            const names = ecosystem && direct.get(ecosystem);
+            if (!names)
+                return false; // unknown/unparseable ecosystem → not our concern
+            return names.has(normalizeName(ecosystem, m.artifact?.name ?? ''));
+        };
+        const isIgnored = (m) => ignore.includes((m.vulnerability?.id ?? '').toLowerCase()) ||
+            ignore.includes((m.artifact?.name ?? '').toLowerCase());
+        const atSeverity = matches.filter(m => severityRank(m.vulnerability?.severity) >= minRank);
+        const findings = atSeverity.filter(m => isDirect(m) && !isIgnored(m));
+        const suppressed = atSeverity.length - findings.length;
+        if (suppressed > 0) {
+            logger.info(`[Grype Scan]: suppressed ${suppressed} finding(s) — transitive/third-party (not directly fixable) or ignored`);
+        }
+        if (findings.length === 0) {
+            logger.info('[Grype Scan]: ✅ No known vulnerabilities in direct dependencies');
+            return pass();
+        }
+        logger.warn(`[Grype Scan]: ⚠️ vulnerabilities in direct dependencies (>= ${minSeverity}):`);
+        findings
+            .slice(0, 10)
+            .forEach(m => logger.warn(`  ${m.vulnerability?.id ?? 'unknown'} — ${m.artifact?.name ?? '?'}@${m.artifact?.version ?? '?'} (${m.vulnerability?.severity ?? '?'})`));
+        if (findings.length > 10)
+            logger.warn(`  ... and ${findings.length - 10} more`);
+        return warn(`${findings.length} direct-dependency vulnerability(ies) at "${minSeverity}"+ (grype)`);
+    },
+};

package/dist/esm/core/checks/dependencies/license-check.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const licenseCheck: Check;

package/dist/esm/core/checks/dependencies/license-check.js

@@ -0,0 +1,61 @@
+import { execa } from '../../../utils/execa.js';
+import { logger, resolvePackageBin, getOwnDependencyClosure } from '../../../utils/index.js';
+import { isNpmProject, pass, fail, skip } from '../../types.js';
+const FORBIDDEN_LICENSES = ['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0'];
+/** Strip the trailing "@version" to get the bare package name (scoped-safe). */
+function bareName(pkgKey) {
+    const at = pkgKey.lastIndexOf('@');
+    return at > 0 ? pkgKey.slice(0, at) : pkgKey;
+}
+export const licenseCheck = {
+    name: 'License Check',
+    phase: 'blocking',
+    applies(ctx) {
+        return isNpmProject(ctx);
+    },
+    async run(ctx) {
+        const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);
+        const allowLicenses = ctx.config.licenseCheck?.allowLicenses ?? [];
+        // pr-checkmate installs into the consumer's node_modules, so its own runtime
+        // deps (eslint plugins, cspell dictionaries, …) leak into the client's
+        // production tree. Those are our dependencies, not the client's — never fail
+        // a client's PR because of a license we ourselves pulled in.
+        const ownDeps = getOwnDependencyClosure();
+        // Resolve the bundled license-checker binary and run it via the current node — never
+        // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
+        let licenseCheckerBin;
+        try {
+            licenseCheckerBin = resolvePackageBin('license-checker-rseidelsohn', 'bin/license-checker-rseidelsohn.js');
+        }
+        catch {
+            return skip('license-checker unavailable');
+        }
+        const { stdout, failed } = await execa(process.execPath, [licenseCheckerBin, '--json', '--production'], { cwd: ctx.cwd, reject: false });
+        let licenses;
+        try {
+            licenses = JSON.parse(stdout);
+        }
+        catch {
+            // Tool couldn't produce parseable output; skip rather than fail the client's PR.
+            return skip(failed ? 'license-checker failed to run' : 'license-checker produced invalid JSON');
+        }
+        const violations = [];
+        for (const [pkg, info] of Object.entries(licenses)) {
+            const name = bareName(pkg);
+            if (allowPackages.has(name) || ownDeps.has(name))
+                continue;
+            const raw = info.licenses ?? '';
+            const license = Array.isArray(raw) ? raw.join(' OR ') : raw;
+            if (allowLicenses.some(a => license.includes(a)))
+                continue;
+            if (FORBIDDEN_LICENSES.some(f => license.includes(f))) {
+                violations.push(`${pkg}: ${license}`);
+            }
+        }
+        if (violations.length > 0) {
+            violations.forEach(v => logger.error(`[License Check]: ❌ ${v}`));
+            return fail(`${violations.length} forbidden license(s)`);
+        }
+        return pass();
+    },
+};

package/dist/esm/core/checks/dependencies/npm-audit.d.ts

@@ -0,0 +1,6 @@
+import { Check } from '../../types.js';
+/**
+ * npm audit — only direct-dependency vulnerabilities block. Transitive ones and
+ * vulnerabilities in pr-checkmate itself are ignored (the client cannot fix those).
+ */
+export declare const npmAuditCheck: Check;

package/dist/esm/core/checks/dependencies/npm-audit.js

@@ -0,0 +1,80 @@
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __dirnameFn } from 'node:path';
+const __dirname = __dirnameFn(__fileURLToPath(import.meta.url));
+import fs from 'node:fs';
+import path from 'node:path';
+import { execa } from '../../../utils/execa.js';
+import { logger, findOwnPackageRoot } from '../../../utils/index.js';
+import { isNpmProject, pass, fail, skip } from '../../types.js';
+const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
+function isSeverityAtLeast(severity, level) {
+    const sevIdx = SEVERITY_ORDER.indexOf(severity);
+    const lvlIdx = SEVERITY_ORDER.indexOf(level);
+    return sevIdx >= 0 && lvlIdx >= 0 && sevIdx >= lvlIdx;
+}
+function getOwnPackageName() {
+    try {
+        const ownPkg = path.join(findOwnPackageRoot() ?? path.resolve(__dirname, '../../../..'), 'package.json');
+        return JSON.parse(fs.readFileSync(ownPkg, 'utf-8')).name ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * npm audit — only direct-dependency vulnerabilities block. Transitive ones and
+ * vulnerabilities in pr-checkmate itself are ignored (the client cannot fix those).
+ */
+export const npmAuditCheck = {
+    name: 'NPM Audit',
+    phase: 'blocking',
+    applies(ctx) {
+        if (ctx.config.security?.['npm-audit']?.enabled === false)
+            return false;
+        return isNpmProject(ctx);
+    },
+    async run(ctx) {
+        // `high`, not `moderate`. A moderate CVE in a direct dependency often has no
+        // fix available, and blocking on it stops the team shipping anything at all —
+        // indefinitely, for a risk they have usually already accepted. A gate that
+        // cannot be satisfied gets switched off, and then the high ones stop blocking
+        // too. Clients who want the stricter line set `security.npm-audit.auditLevel`.
+        const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'high';
+        const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
+        const ownName = getOwnPackageName();
+        const { stdout } = await execa('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
+        // `npm audit` reports registry/lockfile problems as JSON on stdout, but not
+        // always: an absent npm (execa resolves with `code: 'ENOENT'`), a killed
+        // process or a proxy that answers with HTML all leave stdout unparseable.
+        // Parsing it bare made those cases throw, and a throw in a blocking check is
+        // a failed PR — the client saw "NPM Audit threw: Unexpected end of JSON
+        // input" and a red gate for an environment problem they did not cause.
+        let report;
+        try {
+            report = JSON.parse(stdout);
+        }
+        catch {
+            logger.warn('[NPM Audit]: ⚠️ npm audit produced no parseable report — skipping');
+            return skip('npm audit produced no parseable report');
+        }
+        // A repo with no lockfile, or a registry npm cannot reach, yields
+        // `{"error":{"code":"ENOLOCK",…}}` — no `vulnerabilities` key at all. Passing
+        // on that reads as "no vulnerabilities" when nothing was actually audited.
+        if (report.error) {
+            const detail = report.error.summary ?? report.error.code ?? 'unknown error';
+            logger.warn(`[NPM Audit]: ⚠️ npm could not audit this project — ${detail}`);
+            return skip(`npm audit unavailable: ${report.error.code ?? 'error'}`);
+        }
+        const relevant = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
+        const [ignored, directVulns] = relevant.reduce(([skip, block], v) => {
+            (ignore.has(v.name.toLowerCase()) ? skip : block).push(v);
+            return [skip, block];
+        }, [[], []]);
+        // Ignored advisories stay visible as warnings — an exception is not a silent drop.
+        ignored.forEach(v => logger.warn(`[NPM Audit]: ⚠ ${v.name} — severity: ${v.severity} (ignored via config)`));
+        if (directVulns.length === 0)
+            return pass();
+        directVulns.forEach(v => logger.error(`[NPM Audit]: ❌ ${v.name} — severity: ${v.severity}`));
+        return fail(`${directVulns.length} direct vulnerability(ies) at "${auditLevel}"+`);
+    },
+};