pr-checkmate 4.0.1 → 4.1.0

package/dist/cjs/core/checks/quality/yaml-lint.d.ts

@@ -1,3 +1,4 @@
+import { Document, LineCounter } from 'yaml';
 import { Check } from '../../types.js';
 /**
  * True when a parser problem describes something actually wrong with the file —
@@ -6,6 +7,20 @@ import { Check } from '../../types.js';
 export declare function isFileDefect(problem: {
     code?: string;
 }): boolean;
+/**
+ * Aliases (`*name`) that point at an anchor which does not exist before them.
+ *
+ * The parser does not treat this as a parse error: it builds the alias node and only
+ * throws when the document is converted to a JS value, which is exactly what a CI
+ * runner does next. So `doc.errors` stays empty for a pipeline that reuses a step via
+ * `*update-knowledge` after its `&update-knowledge` anchor was deleted, and the check
+ * used to pass a file Bitbucket rejects. Found by walking the alias nodes.
+ */
+export declare function unresolvedAliases(doc: Document.Parsed, lineCounter: LineCounter): {
+    name: string;
+    line: number;
+    col: number;
+}[];
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file

package/dist/cjs/core/checks/quality/yaml-lint.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.yamlLintCheck = void 0;
 exports.isFileDefect = isFileDefect;
+exports.unresolvedAliases = unresolvedAliases;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const yaml_1 = require("yaml");
@@ -38,6 +39,27 @@ const NON_DEFECT_CODES = new Set(['TAG_RESOLVE_FAILED']);
 function isFileDefect(problem) {
     return problem.code === undefined || !NON_DEFECT_CODES.has(problem.code);
 }
+/**
+ * Aliases (`*name`) that point at an anchor which does not exist before them.
+ *
+ * The parser does not treat this as a parse error: it builds the alias node and only
+ * throws when the document is converted to a JS value, which is exactly what a CI
+ * runner does next. So `doc.errors` stays empty for a pipeline that reuses a step via
+ * `*update-knowledge` after its `&update-knowledge` anchor was deleted, and the check
+ * used to pass a file Bitbucket rejects. Found by walking the alias nodes.
+ */
+function unresolvedAliases(doc, lineCounter) {
+    const found = [];
+    (0, yaml_1.visit)(doc, {
+        Alias(_key, node) {
+            if (node.resolve(doc) !== undefined)
+                return;
+            const { line, col } = lineCounter.linePos(node.range?.[0] ?? 0);
+            found.push({ name: node.source, line, col });
+        },
+    });
+    return found;
+}
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
@@ -81,8 +103,18 @@ exports.yamlLintCheck = {
             }
             // parseAllDocuments never throws — it collects problems on each document,
             // so a single malformed file cannot abort the whole check.
-            const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true });
+            const lineCounter = new yaml_1.LineCounter();
+            const docs = (0, yaml_1.parseAllDocuments)(source, { prettyErrors: true, lineCounter });
             for (const doc of docs) {
+                for (const alias of unresolvedAliases(doc, lineCounter)) {
+                    issues.push({
+                        file,
+                        blocking: true,
+                        line: alias.line,
+                        col: alias.col,
+                        message: `Unresolved alias "*${alias.name}" (the anchor must be declared before the alias)`,
+                    });
+                }
                 const problems = [
                     ...doc.errors.map(p => ({ problem: p, blocking: true })),
                     ...doc.warnings.map(p => ({ problem: p, blocking: false })),

package/dist/esm/core/checks/quality/yaml-lint.d.ts

@@ -1,3 +1,4 @@
+import { Document, LineCounter } from 'yaml';
 import { Check } from '../../types.js';
 /**
  * True when a parser problem describes something actually wrong with the file —
@@ -6,6 +7,20 @@ import { Check } from '../../types.js';
 export declare function isFileDefect(problem: {
     code?: string;
 }): boolean;
+/**
+ * Aliases (`*name`) that point at an anchor which does not exist before them.
+ *
+ * The parser does not treat this as a parse error: it builds the alias node and only
+ * throws when the document is converted to a JS value, which is exactly what a CI
+ * runner does next. So `doc.errors` stays empty for a pipeline that reuses a step via
+ * `*update-knowledge` after its `&update-knowledge` anchor was deleted, and the check
+ * used to pass a file Bitbucket rejects. Found by walking the alias nodes.
+ */
+export declare function unresolvedAliases(doc: Document.Parsed, lineCounter: LineCounter): {
+    name: string;
+    line: number;
+    col: number;
+}[];
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file

package/dist/esm/core/checks/quality/yaml-lint.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { parseAllDocuments } from 'yaml';
+import { LineCounter, parseAllDocuments, visit } from 'yaml';
 import { logger, matchesAnyGlob } from '../../../utils/index.js';
 import { resolveTargetFiles } from '../../targets.js';
 import { pass, skip } from '../../types.js';
@@ -31,6 +31,27 @@ const NON_DEFECT_CODES = new Set(['TAG_RESOLVE_FAILED']);
 export function isFileDefect(problem) {
     return problem.code === undefined || !NON_DEFECT_CODES.has(problem.code);
 }
+/**
+ * Aliases (`*name`) that point at an anchor which does not exist before them.
+ *
+ * The parser does not treat this as a parse error: it builds the alias node and only
+ * throws when the document is converted to a JS value, which is exactly what a CI
+ * runner does next. So `doc.errors` stays empty for a pipeline that reuses a step via
+ * `*update-knowledge` after its `&update-knowledge` anchor was deleted, and the check
+ * used to pass a file Bitbucket rejects. Found by walking the alias nodes.
+ */
+export function unresolvedAliases(doc, lineCounter) {
+    const found = [];
+    visit(doc, {
+        Alias(_key, node) {
+            if (node.resolve(doc) !== undefined)
+                return;
+            const { line, col } = lineCounter.linePos(node.range?.[0] ?? 0);
+            found.push({ name: node.source, line, col });
+        },
+    });
+    return found;
+}
 /**
  * Bundled YAML linter (the `yaml` package — no runner dependency, always
  * available like Markdown/Spellcheck). Parses every changed `.yml`/`.yaml` file
@@ -74,8 +95,18 @@ export const yamlLintCheck = {
             }
             // parseAllDocuments never throws — it collects problems on each document,
             // so a single malformed file cannot abort the whole check.
-            const docs = parseAllDocuments(source, { prettyErrors: true });
+            const lineCounter = new LineCounter();
+            const docs = parseAllDocuments(source, { prettyErrors: true, lineCounter });
             for (const doc of docs) {
+                for (const alias of unresolvedAliases(doc, lineCounter)) {
+                    issues.push({
+                        file,
+                        blocking: true,
+                        line: alias.line,
+                        col: alias.col,
+                        message: `Unresolved alias "*${alias.name}" (the anchor must be declared before the alias)`,
+                    });
+                }
                 const problems = [
                     ...doc.errors.map(p => ({ problem: p, blocking: true })),
                     ...doc.warnings.map(p => ({ problem: p, blocking: false })),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "4.0.1",
+    "version": "4.1.0",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",