pr-checkmate 3.0.4 → 3.2.0

package/dist/esm/scripts/publish-github.js

@@ -0,0 +1,45 @@
+import { execSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { logger } from '../utils/index.js';
+function publishToGithub() {
+    const root = process.cwd();
+    const pkgPath = path.join(root, 'package.json');
+    const tempPath = path.join(root, 'package.json.github');
+    const backupPath = path.join(root, 'package.json.bak');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    pkg.name = '@mybono/pr-checkmate';
+    pkg.publishConfig = {
+        registry: 'https://npm.pkg.github.com',
+        access: 'public',
+    };
+    delete pkg.scripts?.prepublishOnly;
+    fs.writeFileSync(tempPath, JSON.stringify(pkg, null, 2));
+    try {
+        // `fs.renameSync` rather than shelling out to `mv`: the paths are built here
+        // and are not attacker-controlled, but a template literal inside execSync is
+        // a shell invocation regardless, and one that runs holding npm credentials.
+        // Found by our own Diff Security once `--full` began reviewing whole files
+        // (ticket 067) — the delta mode could never see it, since the file is old.
+        fs.renameSync(pkgPath, backupPath);
+        fs.renameSync(tempPath, pkgPath);
+        execSync('npm publish --registry=https://npm.pkg.github.com', { stdio: 'inherit' });
+        logger.log('[publishToGithub]: ✅ Published to GitHub Packages');
+    }
+    catch (err) {
+        logger.error(`[publishToGithub]: ${err}`);
+    }
+    finally {
+        // The backup only exists if the first rename succeeded; restoring is
+        // best-effort so a failure here cannot mask the original error.
+        if (fs.existsSync(backupPath)) {
+            try {
+                fs.renameSync(backupPath, pkgPath);
+            }
+            catch (err) {
+                logger.error(`[publishToGithub]: could not restore package.json: ${err}`);
+            }
+        }
+    }
+}
+publishToGithub();

package/dist/esm/utils/ci.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;

package/dist/esm/utils/ci.js

@@ -0,0 +1,40 @@
+/**
+ * Environment variables that mean "this is an automated build". `CI` alone covers
+ * GitHub Actions, GitLab, Bitbucket, CircleCI, Buildkite, Travis and most others;
+ * the rest are providers that either predate the convention or set only their own
+ * marker (Jenkins, TeamCity, Azure Pipelines, AWS CodeBuild).
+ *
+ * This answers a different question from `detectPlatform()` in reporters.ts, which
+ * picks WHERE to post a PR comment and therefore only knows the three platforms we
+ * can comment on. A Jenkins build is CI but has nowhere to post.
+ */
+const CI_ENV_VARS = [
+    'CI',
+    'GITHUB_ACTIONS',
+    'GITLAB_CI',
+    'BITBUCKET_BUILD_NUMBER',
+    'JENKINS_URL',
+    'TEAMCITY_VERSION',
+    'TF_BUILD',
+    'CIRCLECI',
+    'BUILDKITE',
+    'CODEBUILD_BUILD_ID',
+];
+/** Values that are present but mean "no" — some tooling exports `CI=false`. */
+const FALSY = new Set(['', '0', 'false', 'no', 'off']);
+/**
+ * True when running inside a CI/CD build.
+ *
+ * Decides the default review scope: a build looks at the diff (that is the point
+ * of a PR gate), a human at a terminal looks at the whole project — the local
+ * `HEAD^` default used to check only the last commit, so a repo could report a
+ * clean run with a `debugger` sitting in it.
+ *
+ * @param env Environment to inspect. Defaults to the current process.
+ */
+export function isCiEnvironment(env = process.env) {
+    return CI_ENV_VARS.some(name => {
+        const value = env[name];
+        return value !== undefined && !FALSY.has(value.trim().toLowerCase());
+    });
+}

package/dist/esm/utils/detect-language.d.ts

@@ -0,0 +1,48 @@
+/** Client `detect` block: how strictly a language is inferred from the tree. */
+export interface DetectOptions {
+    /** Source files needed to count a language as present. A marker file bypasses it. */
+    minFiles?: number;
+    /** Extra paths excluded from the count, on top of the built-in list. */
+    excludePaths?: string[];
+    /** Languages never reported, whatever the tree looks like. */
+    disable?: Language[];
+}
+export type Language = 'typescript' | 'javascript' | 'python' | 'cpp' | 'swift' | 'kotlin' | 'go' | 'rust' | 'csharp' | 'ruby' | 'php';
+/** One detected language, with the evidence that detected it. */
+export interface LanguageUsage {
+    lang: Language;
+    /** Tracked source files, excluding generated, vendored and manifest files. */
+    files: number;
+    /** A marker file declares the language regardless of the file count. */
+    marker: boolean;
+}
+/**
+ * Detects the languages a repository uses, and *why* each one was detected.
+ *
+ * Two different decisions read this, and they should not read it the same way:
+ *
+ * - **Which checks to run.** A marker is enough. A repo scaffolded from a
+ *   template has `pyproject.toml` and no `.py` yet, and running Python checks on
+ *   it costs nothing but a skip.
+ * - **Which toolchains to download** (ticket 064). A marker is *not* enough — a
+ *   `Cargo.toml` beside zero `.rs` files would pull a Rust profile on every CI
+ *   run for a language nobody has written yet. That decision wants `files > 0`.
+ *
+ * Returning the evidence rather than a bare list is what lets each caller pick.
+ *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
+ * @param detect Client overrides for the heuristics.
+ * @returns languages ordered by tracked file count (most-used first). `.h` headers
+ *   are intentionally excluded from the C++ count since they are ambiguous with C.
+ */
+export declare function detectLanguageUsage(root?: string, ignoreDirs?: string[], detect?: DetectOptions): Promise<LanguageUsage[]>;
+/**
+ * The languages a repository uses, most-used first — the answer to "which checks
+ * should run". See {@link detectLanguageUsage} when the file counts matter, as
+ * they do for deciding what to download.
+ */
+export declare function detectLanguages(root?: string, ignoreDirs?: string[], detect?: DetectOptions): Promise<Language[]>;

package/dist/esm/utils/detect-language.js

@@ -0,0 +1,234 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { IGNORED_DIRS } from '../config/constants.js';
+import { execa } from './execa.js';
+import { globToRegExp, isUnderIgnoredDir, matchesAnyGlob } from './glob.js';
+import { logger } from './logger.js';
+/**
+ * Marker files that unambiguously indicate a language's presence, independent of
+ * how many source files are tracked. Presence of any marker forces detection even
+ * when the file count is low (e.g. a fresh repo scaffolded from a template).
+ */
+const MARKER_FILES = {
+    typescript: ['tsconfig.json'],
+    // Deliberately empty. `package.json` used to sit here, and it is the one marker
+    // this package creates itself: installing pr-checkmate through npm puts a
+    // `package.json` in a repository that may not hold a single line of JavaScript.
+    // A Python service then detected as JavaScript and got the whole JS half of the
+    // report — ESLint, Prettier, NPM Audit, License Check — every row of it about
+    // the file that installed us. `install/profiles.ts` already refused to buy
+    // 152 MB of toolchain off this marker (ticket 064); the checks now refuse to
+    // run off it for the same reason. Real JavaScript is detected by its `.js`,
+    // `.jsx`, `.mjs` and `.cjs` files, and a repository that has none loses
+    // nothing: every JS check it lost would have reported "no files" anyway.
+    javascript: [],
+    python: ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt', 'Pipfile'],
+    cpp: ['CMakeLists.txt', 'compile_commands.json', 'conanfile.txt', 'conanfile.py'],
+    swift: ['Package.swift', 'Package.resolved'],
+    kotlin: [
+        'build.gradle',
+        'build.gradle.kts',
+        'settings.gradle',
+        'settings.gradle.kts',
+        'AndroidManifest.xml',
+    ],
+    go: ['go.mod'],
+    rust: ['Cargo.toml'],
+    // Glob markers (`*.csproj`/`*.sln`) — matched against root dir entries, since
+    // C# projects have no single fixed marker filename.
+    csharp: ['*.csproj', '*.sln'],
+    ruby: ['Gemfile', '.rubocop.yml'],
+    php: ['composer.json'],
+};
+/**
+ * Paths whose files never count towards a language, on top of `ignoreDirs`.
+ *
+ * Every entry here comes from a real client repository, not from imagination:
+ *
+ * - `**\/*UnitTest*\/**` — Gradle/Android writes HTML+JS test reports into
+ *   `tests/testProdReleaseUnitTest_25.4.11/js/`. One generated `report.js` was
+ *   enough to make a 302-file Kotlin project detect as JavaScript.
+ * - `get-pip.py` — vendored bootstrap script, not the project's Python.
+ * - `vendor` / `third_party` — dependencies someone committed; the repo did not
+ *   write them and should not be judged by them.
+ */
+const DEFAULT_DETECT_EXCLUDES = [
+    '**/*UnitTest*/**',
+    '**/get-pip.py',
+    '**/vendor/**',
+    '**/third_party/**',
+];
+/**
+ * Extensions that mean a different language depending on where the file sits.
+ *
+ * `.rs` is Rust almost everywhere — but in an Android project `src/main/rs/`
+ * holds RenderScript, and `BrainEyeAndroid/src/main/rs/yuv2rgb.rs` made a mobile
+ * SDK detect as a Rust project. Real Rust (`build.rs`, `src/main.rs` in a Tauri
+ * app) is unaffected, which is why this is a path rule rather than a count threshold.
+ */
+const EXTENSION_COLLISIONS = [
+    { ext: '.rs', notUnder: /(^|\/)src\/main\/rs\//, lang: 'rust' },
+];
+/**
+ * Source extensions per language, used to count tracked files via `git ls-files`.
+ */
+const EXTENSIONS = {
+    typescript: ['.ts', '.tsx'],
+    javascript: ['.js', '.jsx', '.mjs', '.cjs'],
+    python: ['.py', '.pyi'],
+    cpp: ['.cpp', '.cc', '.cxx', '.c++', '.hpp', '.hh', '.hxx'],
+    swift: ['.swift'],
+    kotlin: ['.kt', '.kts', '.java'],
+    go: ['.go'],
+    rust: ['.rs'],
+    csharp: ['.cs'],
+    ruby: ['.rb', '.rake'],
+    php: ['.php'],
+};
+function hasMarker(root, lang) {
+    return MARKER_FILES[lang].some(name => {
+        if (!name.includes('*'))
+            return fs.existsSync(path.join(root, name));
+        // Glob marker (e.g. `*.csproj`): match against root-directory entries.
+        try {
+            const re = globToRegExp(name);
+            return fs.readdirSync(root).some(entry => re.test(entry));
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Every marker filename that is also a source file, so it is never counted as
+ * one. `Package.swift` is a Swift *manifest*: counting it made a C++ repository
+ * report one Swift source it does not have. Same shape for `setup.py` and
+ * `conanfile.py`.
+ *
+ * The marker still detects the language on its own — that path is untouched.
+ * What changes is only that a manifest no longer inflates the file count, which
+ * is what the install decision in ticket 064 will read.
+ */
+function markerFilenames() {
+    const names = new Set();
+    for (const list of Object.values(MARKER_FILES)) {
+        for (const name of list) {
+            if (!name.includes('*') && path.extname(name))
+                names.add(name);
+        }
+    }
+    return names;
+}
+/** Which language a file counts towards, or null when it counts towards none. */
+function languageOf(file, ext) {
+    for (const collision of EXTENSION_COLLISIONS) {
+        if (ext === collision.ext) {
+            return collision.notUnder.test(file) ? null : collision.lang;
+        }
+    }
+    for (const lang of Object.keys(EXTENSIONS)) {
+        if (EXTENSIONS[lang].includes(ext))
+            return lang;
+    }
+    return null;
+}
+async function countTrackedFiles(root, ignoreDirs, excludePaths) {
+    const counts = {
+        typescript: 0,
+        javascript: 0,
+        python: 0,
+        cpp: 0,
+        swift: 0,
+        kotlin: 0,
+        go: 0,
+        rust: 0,
+        csharp: 0,
+        ruby: 0,
+        php: 0,
+    };
+    try {
+        const { stdout } = await execa('git', ['ls-files'], { cwd: root });
+        const files = stdout.split('\n').map(f => f.trim());
+        const ignored = new Set(ignoreDirs);
+        const markers = markerFilenames();
+        for (const file of files) {
+            if (!file)
+                continue;
+            // A repository that commits its dependencies (`node_modules`, `vendor`,
+            // `third_party`) would otherwise be detected as a Python/Go/PHP project off
+            // the back of files nobody in it wrote, switching on whole toolchains for
+            // languages absent from the source. Detection has to describe the repo's own
+            // code, since it decides which checks run at all — the same exclusion every
+            // check's file list already applies via `excludeIgnoredDirs`.
+            if (isUnderIgnoredDir(file, ignored))
+                continue;
+            // Generated reports and vendored bootstrap scripts are not the repo's code.
+            if (matchesAnyGlob(file, excludePaths))
+                continue;
+            // A manifest that happens to be source-shaped (`Package.swift`) declares a
+            // language; it is not a line of it.
+            if (markers.has(path.basename(file)))
+                continue;
+            const lang = languageOf(file, path.extname(file).toLowerCase());
+            if (lang)
+                counts[lang] += 1;
+        }
+    }
+    catch {
+        logger.debug('[detectLanguages]: git ls-files unavailable, using marker files only');
+    }
+    return counts;
+}
+/**
+ * Detects the languages a repository uses, and *why* each one was detected.
+ *
+ * Two different decisions read this, and they should not read it the same way:
+ *
+ * - **Which checks to run.** A marker is enough. A repo scaffolded from a
+ *   template has `pyproject.toml` and no `.py` yet, and running Python checks on
+ *   it costs nothing but a skip.
+ * - **Which toolchains to download** (ticket 064). A marker is *not* enough — a
+ *   `Cargo.toml` beside zero `.rs` files would pull a Rust profile on every CI
+ *   run for a language nobody has written yet. That decision wants `files > 0`.
+ *
+ * Returning the evidence rather than a bare list is what lets each caller pick.
+ *
+ * @param root Repository root.
+ * @param ignoreDirs Directory names whose contents do not count as the repo's own
+ *   code. Defaults to the curated list; `buildContext` passes the client's
+ *   `ignoreDirs` so a repo that vendors dependencies is described by its own
+ *   sources. Marker files are unaffected — they are only ever read from `root`.
+ * @param detect Client overrides for the heuristics.
+ * @returns languages ordered by tracked file count (most-used first). `.h` headers
+ *   are intentionally excluded from the C++ count since they are ambiguous with C.
+ */
+export async function detectLanguageUsage(root = process.cwd(), ignoreDirs = IGNORED_DIRS, detect = {}) {
+    const excludePaths = [...DEFAULT_DETECT_EXCLUDES, ...(detect.excludePaths ?? [])];
+    const counts = await countTrackedFiles(root, ignoreDirs, excludePaths);
+    // 1 by default: with the causes of the false positives fixed above, a single
+    // real source file is a real language. The knob exists for repositories that
+    // carry stray one-off scripts they would rather not have checked.
+    const minFiles = Math.max(1, detect.minFiles ?? 1);
+    const disabled = new Set(detect.disable ?? []);
+    const detected = [];
+    for (const lang of Object.keys(EXTENSIONS)) {
+        if (disabled.has(lang))
+            continue;
+        const marker = hasMarker(root, lang);
+        if (marker || counts[lang] >= minFiles)
+            detected.push({ lang, files: counts[lang], marker });
+    }
+    detected.sort((a, b) => b.files - a.files);
+    const countStr = Object.keys(counts).map(l => `${l}=${counts[l]}`).join(', ');
+    const names = detected.map(u => u.lang).join(', ');
+    logger.info(`[detectLanguages]: Detected ${names || 'none'} (counts: ${countStr})`);
+    return detected;
+}
+/**
+ * The languages a repository uses, most-used first — the answer to "which checks
+ * should run". See {@link detectLanguageUsage} when the file counts matter, as
+ * they do for deciding what to download.
+ */
+export async function detectLanguages(root = process.cwd(), ignoreDirs = IGNORED_DIRS, detect = {}) {
+    return (await detectLanguageUsage(root, ignoreDirs, detect)).map(u => u.lang);
+}

package/dist/esm/utils/direct-deps.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Package ecosystems for which we can determine a project's DIRECT (declared)
+ * dependencies from a manifest — the set a maintainer actually controls and can
+ * bump. Transitive packages (resolved only in a lockfile) are deliberately not
+ * here: the consumer cannot fix them directly, so a vuln scan must not flag them.
+ */
+export type Ecosystem = 'npm' | 'python' | 'go' | 'rust' | 'ruby' | 'php';
+/** Canonical key for name comparison within an ecosystem. */
+export declare function normalizeName(ecosystem: Ecosystem, name: string): string;
+/**
+ * Build the set of DIRECT (declared) dependency names for `cwd`, keyed by
+ * ecosystem, by parsing manifests — not lockfiles. Used to filter vulnerability
+ * scanner output down to what the consumer actually controls: transitive
+ * dependencies (present only in lockfiles) and the scanning tool's own bundled
+ * dependencies are absent from these manifests and thus never reported.
+ *
+ * Dependency-free and best-effort: unparseable/absent manifests contribute
+ * nothing rather than throwing. An ecosystem with no manifest yields no entry
+ * (callers should treat "no entry" as "cannot classify" — see grype-scan).
+ */
+export declare function collectDirectDeps(cwd: string): Map<Ecosystem, Set<string>>;

package/dist/esm/utils/direct-deps.js

@@ -0,0 +1,220 @@
+import { createRequire as __createRequire } from 'node:module';
+const require = __createRequire(import.meta.url);
+import fs from 'node:fs';
+import path from 'node:path';
+/** Directories never worth descending into when locating manifests. */
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'vendor',
+    '.venv',
+    'venv',
+    'target',
+]);
+/** PEP 503 normalisation, applied to both manifest and scanner names for Python. */
+function normalizePython(name) {
+    return name
+        .trim()
+        .toLowerCase()
+        .replace(/[-_.]+/g, '-');
+}
+/** Canonical key for name comparison within an ecosystem. */
+export function normalizeName(ecosystem, name) {
+    return ecosystem === 'python' ? normalizePython(name) : name.trim().toLowerCase();
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function readText(file) {
+    try {
+        return fs.readFileSync(file, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Collect direct dep names from a package.json's four dependency maps. */
+function addNpm(file, out) {
+    const pkg = readJson(file);
+    if (!pkg)
+        return;
+    for (const key of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies',
+    ]) {
+        const map = pkg[key];
+        if (map && typeof map === 'object') {
+            for (const name of Object.keys(map))
+                out.add(normalizeName('npm', name));
+        }
+    }
+}
+/** Extract the bare package name from a Python requirement specifier line. */
+function pythonReqName(line) {
+    const stripped = line.split('#')[0].trim();
+    if (!stripped || stripped.startsWith('-'))
+        return null; // skip options like -r / -e
+    const match = /^([A-Za-z0-9._-]+)/.exec(stripped);
+    return match ? normalizePython(match[1]) : null;
+}
+function addPython(cwd, out, manifests) {
+    for (const file of manifests) {
+        const base = path.basename(file);
+        if (base.startsWith('requirements') && base.endsWith('.txt')) {
+            const text = readText(file);
+            if (text)
+                text.split('\n').forEach(l => {
+                    const n = pythonReqName(l);
+                    if (n)
+                        out.add(n);
+                });
+        }
+        else if (base === 'pyproject.toml' || base === 'Pipfile') {
+            const text = readText(file);
+            if (!text)
+                continue;
+            // Best-effort, parser-free: PEP 621 `dependencies = ["pkg>=1", ...]`,
+            // Poetry/Pipfile `pkg = "^1.2"` table entries. Section-agnostic on purpose.
+            for (const m of text.matchAll(/["']([A-Za-z0-9._-]+)\s*(?:[<>=!~;)\[]|["'])/g)) {
+                const n = normalizePython(m[1]);
+                if (n && n !== 'python')
+                    out.add(n);
+            }
+            for (const m of text.matchAll(/^\s*([A-Za-z0-9._-]+)\s*=/gm)) {
+                const n = normalizePython(m[1]);
+                if (n && n !== 'python')
+                    out.add(n);
+            }
+        }
+    }
+}
+function addGo(file, out) {
+    const text = readText(file);
+    if (!text)
+        return;
+    // `require ( ... )` block and single-line `require x v...`; skip `// indirect`.
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (line.includes('// indirect'))
+            continue;
+        const m = /^(?:require\s+)?([a-zA-Z0-9._~/-]+\.[a-zA-Z0-9._~/-]+)\s+v/.exec(line);
+        if (m)
+            out.add(m[1].toLowerCase());
+    }
+}
+function addRust(file, out) {
+    const text = readText(file);
+    if (!text)
+        return;
+    // Keys under [dependencies] / [dev-dependencies] / [build-dependencies].
+    let inDeps = false;
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (line.startsWith('[')) {
+            inDeps = /^\[(?:.*\.)?(?:dev-|build-)?dependencies\]$/.test(line);
+            continue;
+        }
+        if (!inDeps)
+            continue;
+        const m = /^([A-Za-z0-9._-]+)\s*=/.exec(line);
+        if (m)
+            out.add(m[1].toLowerCase());
+    }
+}
+function addRuby(file, out) {
+    const text = readText(file);
+    if (!text)
+        return;
+    for (const m of text.matchAll(/^\s*gem\s+["']([A-Za-z0-9._-]+)["']/gm)) {
+        out.add(m[1].toLowerCase());
+    }
+}
+function addPhp(file, out) {
+    const pkg = readJson(file);
+    if (!pkg)
+        return;
+    for (const key of ['require', 'require-dev']) {
+        const map = pkg[key];
+        if (map && typeof map === 'object') {
+            for (const name of Object.keys(map)) {
+                if (name === 'php' || name.startsWith('ext-'))
+                    continue;
+                out.add(name.toLowerCase());
+            }
+        }
+    }
+}
+/** Recursively list files matching any of `names`, skipping vendored dirs. */
+function findManifests(cwd, names, matchPrefix) {
+    const found = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
+                    walk(path.join(dir, entry.name));
+                }
+            }
+            else if (names.has(entry.name) || (matchPrefix && matchPrefix.test(entry.name))) {
+                found.push(path.join(dir, entry.name));
+            }
+        }
+    };
+    walk(cwd);
+    return found;
+}
+/**
+ * Build the set of DIRECT (declared) dependency names for `cwd`, keyed by
+ * ecosystem, by parsing manifests — not lockfiles. Used to filter vulnerability
+ * scanner output down to what the consumer actually controls: transitive
+ * dependencies (present only in lockfiles) and the scanning tool's own bundled
+ * dependencies are absent from these manifests and thus never reported.
+ *
+ * Dependency-free and best-effort: unparseable/absent manifests contribute
+ * nothing rather than throwing. An ecosystem with no manifest yields no entry
+ * (callers should treat "no entry" as "cannot classify" — see grype-scan).
+ */
+export function collectDirectDeps(cwd) {
+    const result = new Map();
+    const npm = new Set();
+    findManifests(cwd, new Set(['package.json'])).forEach(f => addNpm(f, npm));
+    if (npm.size)
+        result.set('npm', npm);
+    const python = new Set();
+    const pyManifests = findManifests(cwd, new Set(['pyproject.toml', 'Pipfile']), /^requirements.*\.txt$/);
+    addPython(cwd, python, pyManifests);
+    if (python.size)
+        result.set('python', python);
+    const go = new Set();
+    findManifests(cwd, new Set(['go.mod'])).forEach(f => addGo(f, go));
+    if (go.size)
+        result.set('go', go);
+    const rust = new Set();
+    findManifests(cwd, new Set(['Cargo.toml'])).forEach(f => addRust(f, rust));
+    if (rust.size)
+        result.set('rust', rust);
+    const ruby = new Set();
+    findManifests(cwd, new Set(['Gemfile'])).forEach(f => addRuby(f, ruby));
+    if (ruby.size)
+        result.set('ruby', ruby);
+    const php = new Set();
+    findManifests(cwd, new Set(['composer.json'])).forEach(f => addPhp(f, php));
+    if (php.size)
+        result.set('php', php);
+    return result;
+}

package/dist/esm/utils/execa.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Lazy loader for {@link https://github.com/sindresorhus/execa | execa}.
+ *
+ * execa v9 is ESM-only. Because this package compiles to CommonJS, importing
+ * execa at module scope forces every consumer to resolve execa's full
+ * dependency graph the moment they import pr-checkmate — even consumers that
+ * only need the types or a config helper and never run a check. That graph
+ * pulls in transitive packages (e.g. `unicorn-magic`) whose `exports` maps some
+ * loaders such as `tsx` fail to resolve, which crashes the import for those
+ * consumers before any check runs.
+ *
+ * Loading execa on first use keeps the library entry point cheap and avoids
+ * dragging the subprocess toolchain into consumers that never spawn a process.
+ */
+import type { Options, Result } from 'execa';
+/**
+ * Run a command via execa, loading the module lazily on first call.
+ *
+ * Drop-in replacement for `execa(file, args, options)` at every call site in
+ * this package — all of which await the result and read it synchronously.
+ */
+export declare function execa<OptionsType extends Options = {}>(file: string, args?: readonly string[], options?: OptionsType): Promise<Result<OptionsType>>;

package/dist/esm/utils/execa.js

@@ -0,0 +1,10 @@
+/**
+ * Run a command via execa, loading the module lazily on first call.
+ *
+ * Drop-in replacement for `execa(file, args, options)` at every call site in
+ * this package — all of which await the result and read it synchronously.
+ */
+export async function execa(file, args, options) {
+    const { execa: run } = await import('execa');
+    return (await run(file, args, options));
+}

package/dist/esm/utils/git.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+export declare function resolveGitRef(cwd: string, ref: string): Promise<string | undefined>;