pr-checkmate 3.2.0 → 3.2.2

package/dist/cjs/core/checks/dependencies/grype-scan.d.ts

@@ -1,3 +1,4 @@
+import type { GrypeScanEnvOverrides, PRCheckMateConfig } from '../../../interfaces/index.js';
 import { Check } from '../../types.js';
 /**
  * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
@@ -19,4 +20,11 @@ import { Check } from '../../types.js';
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+export declare function resolveGrypeScan(config: PRCheckMateConfig['grypeScan'], env?: NodeJS.ProcessEnv): GrypeScanEnvOverrides;
 export declare const grypeScanCheck: Check;

package/dist/cjs/core/checks/dependencies/grype-scan.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.grypeScanCheck = void 0;
+exports.resolveGrypeScan = resolveGrypeScan;
 const execa_js_1 = require("../../../utils/execa.js");
 const index_js_1 = require("../../../utils/index.js");
 const types_js_1 = require("../../types.js");
@@ -43,17 +44,30 @@ function severityRank(severity) {
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+function resolveGrypeScan(config, env = process.env) {
+    const { ci, local, ...base } = config ?? {};
+    const overrides = ((0, index_js_1.isCiEnvironment)(env) ? ci : local) ?? {};
+    const defined = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));
+    return { ...base, ...defined };
+}
 exports.grypeScanCheck = {
     name: 'Grype Scan',
     phase: 'informational',
     weight: 'heavy',
     applies(ctx) {
-        return ctx.config.grypeScan?.enabled !== false;
+        return resolveGrypeScan(ctx.config.grypeScan).enabled !== false;
     },
     async run(ctx) {
-        const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
+        const settings = resolveGrypeScan(ctx.config.grypeScan);
+        const minSeverity = (settings.minSeverity ?? 'medium').toLowerCase();
         const minRank = severityRank(minSeverity);
-        const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
+        const ignore = (settings.ignore ?? []).map(s => s.toLowerCase());
         // Never walk `ignoreDirs` — the same contract every other check honours, and
         // here it is the difference between a usable check and an unusable one. A bare
         // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
@@ -61,7 +75,7 @@ exports.grypeScanCheck = {
         // findings: grype resolves package versions from the lockfile, and installed
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
-        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         const result = await (0, execa_js_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,

package/dist/cjs/interfaces/index.d.ts

@@ -369,6 +369,13 @@ export interface PRCheckMateConfig {
          * can never stall a commit.
          */
         timeoutMs?: number;
+        /**
+         * Overrides applied only on a CI build (see `isCiEnvironment`). Any key set here wins
+         * over the top-level value, so CI can keep the scan while local runs turn it off.
+         */
+        ci?: GrypeScanEnvOverrides;
+        /** Same as `ci`, applied only outside CI (a developer's machine, `be-commit`, hooks). */
+        local?: GrypeScanEnvOverrides;
     };
     bannedImports?: Array<{
         name: string;
@@ -430,3 +437,10 @@ export interface PRCheckMateConfig {
 }
 export type { CheckStatus, CheckResult } from '../utils/result-collector.js';
 export type { Language } from '../utils/detect-language.js';
+/** Per-environment overrides for `grypeScan`: the subset of its settings that may differ by environment. */
+export interface GrypeScanEnvOverrides {
+    enabled?: boolean;
+    minSeverity?: 'negligible' | 'low' | 'medium' | 'high' | 'critical';
+    ignore?: string[];
+    timeoutMs?: number;
+}

package/dist/esm/core/checks/dependencies/grype-scan.d.ts

@@ -1,3 +1,4 @@
+import type { GrypeScanEnvOverrides, PRCheckMateConfig } from '../../../interfaces/index.js';
 import { Check } from '../../types.js';
 /**
  * Dependency vulnerability scan via Anchore's `grype`. Non-blocking and ON by
@@ -19,4 +20,11 @@ import { Check } from '../../types.js';
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+export declare function resolveGrypeScan(config: PRCheckMateConfig['grypeScan'], env?: NodeJS.ProcessEnv): GrypeScanEnvOverrides;
 export declare const grypeScanCheck: Check;

package/dist/esm/core/checks/dependencies/grype-scan.js

@@ -1,5 +1,5 @@
 import { execa } from '../../../utils/execa.js';
-import { collectDirectDeps, logger, normalizeName } from '../../../utils/index.js';
+import { collectDirectDeps, isCiEnvironment, logger, normalizeName, } from '../../../utils/index.js';
 import { pass, skip, warn } from '../../types.js';
 import { notInstalled } from '../tool-install.js';
 const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
@@ -40,17 +40,30 @@ function severityRank(severity) {
  * installed `node_modules` is minutes of work whose every finding this check then
  * throws away as third-party.
  */
+/**
+ * The effective grypeScan settings for this run: the top-level values, with the
+ * `ci` or `local` block layered on top depending on where we are running. Only
+ * keys actually set in the block win, so `local: { enabled: false }` leaves the
+ * severity and ignore list alone.
+ */
+export function resolveGrypeScan(config, env = process.env) {
+    const { ci, local, ...base } = config ?? {};
+    const overrides = (isCiEnvironment(env) ? ci : local) ?? {};
+    const defined = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));
+    return { ...base, ...defined };
+}
 export const grypeScanCheck = {
     name: 'Grype Scan',
     phase: 'informational',
     weight: 'heavy',
     applies(ctx) {
-        return ctx.config.grypeScan?.enabled !== false;
+        return resolveGrypeScan(ctx.config.grypeScan).enabled !== false;
     },
     async run(ctx) {
-        const minSeverity = (ctx.config.grypeScan?.minSeverity ?? 'medium').toLowerCase();
+        const settings = resolveGrypeScan(ctx.config.grypeScan);
+        const minSeverity = (settings.minSeverity ?? 'medium').toLowerCase();
         const minRank = severityRank(minSeverity);
-        const ignore = (ctx.config.grypeScan?.ignore ?? []).map(s => s.toLowerCase());
+        const ignore = (settings.ignore ?? []).map(s => s.toLowerCase());
         // Never walk `ignoreDirs` — the same contract every other check honours, and
         // here it is the difference between a usable check and an unusable one. A bare
         // `grype dir:.` catalogs every file under `node_modules`, which on this repo took
@@ -58,7 +71,7 @@ export const grypeScanCheck = {
         // findings: grype resolves package versions from the lockfile, and installed
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
-        const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const timeout = settings.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         const result = await execa('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,

package/dist/esm/interfaces/index.d.ts

@@ -369,6 +369,13 @@ export interface PRCheckMateConfig {
          * can never stall a commit.
          */
         timeoutMs?: number;
+        /**
+         * Overrides applied only on a CI build (see `isCiEnvironment`). Any key set here wins
+         * over the top-level value, so CI can keep the scan while local runs turn it off.
+         */
+        ci?: GrypeScanEnvOverrides;
+        /** Same as `ci`, applied only outside CI (a developer's machine, `be-commit`, hooks). */
+        local?: GrypeScanEnvOverrides;
     };
     bannedImports?: Array<{
         name: string;
@@ -430,3 +437,10 @@ export interface PRCheckMateConfig {
 }
 export type { CheckStatus, CheckResult } from '../utils/result-collector.js';
 export type { Language } from '../utils/detect-language.js';
+/** Per-environment overrides for `grypeScan`: the subset of its settings that may differ by environment. */
+export interface GrypeScanEnvOverrides {
+    enabled?: boolean;
+    minSeverity?: 'negligible' | 'low' | 'medium' | 'high' | 'critical';
+    ignore?: string[];
+    timeoutMs?: number;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "3.2.0",
+    "version": "3.2.2",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",

package/pr-checkmate.schema.json

@@ -221,6 +221,14 @@
         "timeoutMs": {
           "type": "number",
           "default": 120000
+        },
+        "ci": {
+          "$ref": "#/$defs/grypeScanEnvOverrides",
+          "description": "Overrides applied only on a CI build."
+        },
+        "local": {
+          "$ref": "#/$defs/grypeScanEnvOverrides",
+          "description": "Overrides applied only outside CI (developer machine, local commits)."
         }
       },
       "description": "Direct-dependency vulnerability scan via grype."
@@ -1067,6 +1075,18 @@
     }
   },
   "$defs": {
+    "grypeScanEnvOverrides": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "minSeverity": {
+          "type": "string",
+          "enum": ["negligible", "low", "medium", "high", "critical"]
+        },
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
+      }
+    },
     "toggle": {
       "type": "object",
       "properties": {

package/src/config/pr-checkmate.schema.json

@@ -221,6 +221,14 @@
         "timeoutMs": {
           "type": "number",
           "default": 120000
+        },
+        "ci": {
+          "$ref": "#/$defs/grypeScanEnvOverrides",
+          "description": "Overrides applied only on a CI build."
+        },
+        "local": {
+          "$ref": "#/$defs/grypeScanEnvOverrides",
+          "description": "Overrides applied only outside CI (developer machine, local commits)."
         }
       },
       "description": "Direct-dependency vulnerability scan via grype."
@@ -1067,6 +1075,18 @@
     }
   },
   "$defs": {
+    "grypeScanEnvOverrides": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "minSeverity": {
+          "type": "string",
+          "enum": ["negligible", "low", "medium", "high", "critical"]
+        },
+        "ignore": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "number" }
+      }
+    },
     "toggle": {
       "type": "object",
       "properties": {