pr-checkmate 4.1.0 → 4.1.1

package/dist/cjs/core/checks/quality/package-size.d.ts

@@ -20,6 +20,13 @@ interface PackManifest {
  * package" and the check into a permanent skip.
  */
 export declare function pickManifest(parsed: unknown): PackManifest | null;
+type PackResult = {
+    manifest: PackManifest;
+} | {
+    failure: QueryFailure;
+};
+/** Describes a package as `npm pack` would; swapped out by tests that must not reach a registry. */
+export type PackFn = (cwd: string, spec?: string, registry?: string) => Promise<PackResult>;
 /** Why we could not read a published version. */
 type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
 /**
@@ -54,5 +61,6 @@ export declare function classifyQueryFailure(stderr: string): QueryFailure;
  * WASM binary landed — and a red build for it would be wrong. `severity:
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
+export declare function createPackageSizeCheck(pack?: PackFn): Check;
 export declare const packageSizeCheck: Check;
 export {};

package/dist/cjs/core/checks/quality/package-size.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.packageSizeCheck = void 0;
 exports.pickManifest = pickManifest;
 exports.classifyQueryFailure = classifyQueryFailure;
+exports.createPackageSizeCheck = createPackageSizeCheck;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_js_1 = require("../../../utils/execa.js");
@@ -16,6 +17,13 @@ const findings_js_1 = require("../findings.js");
 const DEFAULT_MAX_GROWTH = 20;
 /** How many of the files behind the growth are named. */
 const NAMED_FILES = 5;
+/**
+ * How long one registry request may take, and how long the whole `npm pack` may
+ * run. A registry that does not answer must end as "could not read", not as a
+ * check that holds the report for npm's default retry schedule.
+ */
+const NPM_FETCH_TIMEOUT_MS = 10000;
+const NPM_TIMEOUT_MS = 30000;
 /**
  * The manifest out of whatever `npm pack --json` printed.
  *
@@ -59,9 +67,11 @@ async function packManifest(cwd, spec, registry) {
         '--dry-run',
         '--json',
         '--ignore-scripts',
+        '--fetch-retries=0',
+        `--fetch-timeout=${NPM_FETCH_TIMEOUT_MS}`,
         ...(registry ? ['--registry', registry] : []),
     ];
-    const result = await (0, execa_js_1.execa)('npm', args, { cwd, reject: false });
+    const result = await (0, execa_js_1.execa)('npm', args, { cwd, reject: false, timeout: NPM_TIMEOUT_MS });
     if (result.exitCode !== 0)
         return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
@@ -154,66 +164,69 @@ function published(cwd) {
  * WASM binary landed — and a red build for it would be wrong. `severity:
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
-exports.packageSizeCheck = {
-    name: 'Package Size',
-    phase: 'informational',
-    weight: 'heavy',
-    applies(ctx) {
-        if (ctx.config.packageSize?.enabled === false)
-            return false;
-        // A private package is never published, so there is nothing to compare with
-        // and no consumer to pay for the growth.
-        return published(ctx.cwd) !== null;
-    },
-    async run(ctx) {
-        const target = published(ctx.cwd);
-        if (!target)
-            return (0, types_js_1.skip)('no publishable package.json');
-        const tag = ctx.config.packageSize?.compareWith ?? 'latest';
-        const maxGrowth = ctx.config.packageSize?.maxGrowthPercent ?? DEFAULT_MAX_GROWTH;
-        const spec = `${target.name}@${tag}`;
-        const local = await packManifest(ctx.cwd);
-        if (!('manifest' in local))
-            return (0, types_js_1.skip)('npm could not describe this package');
-        const current = local.manifest;
-        // Never a pass: a green row over a comparison that did not happen is the
-        // mistake of ticket 072. And never one reason standing in for three — the
-        // three are different situations for the reader, and only one of them is a
-        // fact about the package rather than about the run.
-        const remote = await packManifest(ctx.cwd, spec, target.registry);
-        if (!('manifest' in remote)) {
-            // The fact, and nothing past it. The remedy for a private registry is three
-            // lines in a workflow — `setup-node` with `registry-url`, a scope, and
-            // `NODE_AUTH_TOKEN`, because npm reads the token through a reference in
-            // `.npmrc` — and instructions that do not fit cannot be followed. They
-            // belong on the check's page, which the report already links to.
-            //
-            // The package name is left out on purpose: the reader owns it. The host is
-            // not, because it is the one part they cannot infer — and the difference
-            // between "we asked the wrong registry" and "we were refused" is exactly
-            // what this row got wrong before.
-            // Named only when we know it. Without `publishConfig.registry` npm used
-            // whatever the client's own config points at, and we do not know what that
-            // was — "at the registry" would be filler dressed up as information.
-            const host = target.registry ? new URL(target.registry).host : null;
-            const at = host ? ` at ${host}` : '';
-            const reason = {
-                absent: `nothing published under this name${at} yet`,
-                unauthenticated: `no credentials for ${host ?? 'the registry'}`,
-                unreadable: `could not read the published version${at}`,
-            }[remote.failure];
-            return (0, types_js_1.skip)(reason);
-        }
-        const previous = remote.manifest;
-        const delta = current.unpackedSize - previous.unpackedSize;
-        const growth = previous.unpackedSize > 0 ? (delta / previous.unpackedSize) * 100 : 0;
-        const summary = `${mb(previous.unpackedSize)} → ${mb(current.unpackedSize)} ` +
-            `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${previous.version}`;
-        if (growth <= maxGrowth) {
-            index_js_1.logger.info(`[Package Size]: ✅ ${summary}`);
-            return (0, types_js_1.pass)(summary);
-        }
-        (0, findings_js_1.logSample)('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
-        return (0, types_js_1.warn)(summary);
-    },
-};
+function createPackageSizeCheck(pack = packManifest) {
+    return {
+        name: 'Package Size',
+        phase: 'informational',
+        weight: 'heavy',
+        applies(ctx) {
+            if (ctx.config.packageSize?.enabled === false)
+                return false;
+            // A private package is never published, so there is nothing to compare with
+            // and no consumer to pay for the growth.
+            return published(ctx.cwd) !== null;
+        },
+        async run(ctx) {
+            const target = published(ctx.cwd);
+            if (!target)
+                return (0, types_js_1.skip)('no publishable package.json');
+            const tag = ctx.config.packageSize?.compareWith ?? 'latest';
+            const maxGrowth = ctx.config.packageSize?.maxGrowthPercent ?? DEFAULT_MAX_GROWTH;
+            const spec = `${target.name}@${tag}`;
+            const local = await pack(ctx.cwd);
+            if (!('manifest' in local))
+                return (0, types_js_1.skip)('npm could not describe this package');
+            const current = local.manifest;
+            // Never a pass: a green row over a comparison that did not happen is the
+            // mistake of ticket 072. And never one reason standing in for three — the
+            // three are different situations for the reader, and only one of them is a
+            // fact about the package rather than about the run.
+            const remote = await pack(ctx.cwd, spec, target.registry);
+            if (!('manifest' in remote)) {
+                // The fact, and nothing past it. The remedy for a private registry is three
+                // lines in a workflow — `setup-node` with `registry-url`, a scope, and
+                // `NODE_AUTH_TOKEN`, because npm reads the token through a reference in
+                // `.npmrc` — and instructions that do not fit cannot be followed. They
+                // belong on the check's page, which the report already links to.
+                //
+                // The package name is left out on purpose: the reader owns it. The host is
+                // not, because it is the one part they cannot infer — and the difference
+                // between "we asked the wrong registry" and "we were refused" is exactly
+                // what this row got wrong before.
+                // Named only when we know it. Without `publishConfig.registry` npm used
+                // whatever the client's own config points at, and we do not know what that
+                // was — "at the registry" would be filler dressed up as information.
+                const host = target.registry ? new URL(target.registry).host : null;
+                const at = host ? ` at ${host}` : '';
+                const reason = {
+                    absent: `nothing published under this name${at} yet`,
+                    unauthenticated: `no credentials for ${host ?? 'the registry'}`,
+                    unreadable: `could not read the published version${at}`,
+                }[remote.failure];
+                return (0, types_js_1.skip)(reason);
+            }
+            const previous = remote.manifest;
+            const delta = current.unpackedSize - previous.unpackedSize;
+            const growth = previous.unpackedSize > 0 ? (delta / previous.unpackedSize) * 100 : 0;
+            const summary = `${mb(previous.unpackedSize)} → ${mb(current.unpackedSize)} ` +
+                `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${previous.version}`;
+            if (growth <= maxGrowth) {
+                index_js_1.logger.info(`[Package Size]: ✅ ${summary}`);
+                return (0, types_js_1.pass)(summary);
+            }
+            (0, findings_js_1.logSample)('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
+            return (0, types_js_1.warn)(summary);
+        },
+    };
+}
+exports.packageSizeCheck = createPackageSizeCheck();

package/dist/esm/core/checks/quality/package-size.d.ts

@@ -20,6 +20,13 @@ interface PackManifest {
  * package" and the check into a permanent skip.
  */
 export declare function pickManifest(parsed: unknown): PackManifest | null;
+type PackResult = {
+    manifest: PackManifest;
+} | {
+    failure: QueryFailure;
+};
+/** Describes a package as `npm pack` would; swapped out by tests that must not reach a registry. */
+export type PackFn = (cwd: string, spec?: string, registry?: string) => Promise<PackResult>;
 /** Why we could not read a published version. */
 type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
 /**
@@ -54,5 +61,6 @@ export declare function classifyQueryFailure(stderr: string): QueryFailure;
  * WASM binary landed — and a red build for it would be wrong. `severity:
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
+export declare function createPackageSizeCheck(pack?: PackFn): Check;
 export declare const packageSizeCheck: Check;
 export {};

package/dist/esm/core/checks/quality/package-size.js

@@ -8,6 +8,13 @@ import { logSample } from '../findings.js';
 const DEFAULT_MAX_GROWTH = 20;
 /** How many of the files behind the growth are named. */
 const NAMED_FILES = 5;
+/**
+ * How long one registry request may take, and how long the whole `npm pack` may
+ * run. A registry that does not answer must end as "could not read", not as a
+ * check that holds the report for npm's default retry schedule.
+ */
+const NPM_FETCH_TIMEOUT_MS = 10000;
+const NPM_TIMEOUT_MS = 30000;
 /**
  * The manifest out of whatever `npm pack --json` printed.
  *
@@ -51,9 +58,11 @@ async function packManifest(cwd, spec, registry) {
         '--dry-run',
         '--json',
         '--ignore-scripts',
+        '--fetch-retries=0',
+        `--fetch-timeout=${NPM_FETCH_TIMEOUT_MS}`,
         ...(registry ? ['--registry', registry] : []),
     ];
-    const result = await execa('npm', args, { cwd, reject: false });
+    const result = await execa('npm', args, { cwd, reject: false, timeout: NPM_TIMEOUT_MS });
     if (result.exitCode !== 0)
         return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
@@ -146,66 +155,69 @@ function published(cwd) {
  * WASM binary landed — and a red build for it would be wrong. `severity:
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
-export const packageSizeCheck = {
-    name: 'Package Size',
-    phase: 'informational',
-    weight: 'heavy',
-    applies(ctx) {
-        if (ctx.config.packageSize?.enabled === false)
-            return false;
-        // A private package is never published, so there is nothing to compare with
-        // and no consumer to pay for the growth.
-        return published(ctx.cwd) !== null;
-    },
-    async run(ctx) {
-        const target = published(ctx.cwd);
-        if (!target)
-            return skip('no publishable package.json');
-        const tag = ctx.config.packageSize?.compareWith ?? 'latest';
-        const maxGrowth = ctx.config.packageSize?.maxGrowthPercent ?? DEFAULT_MAX_GROWTH;
-        const spec = `${target.name}@${tag}`;
-        const local = await packManifest(ctx.cwd);
-        if (!('manifest' in local))
-            return skip('npm could not describe this package');
-        const current = local.manifest;
-        // Never a pass: a green row over a comparison that did not happen is the
-        // mistake of ticket 072. And never one reason standing in for three — the
-        // three are different situations for the reader, and only one of them is a
-        // fact about the package rather than about the run.
-        const remote = await packManifest(ctx.cwd, spec, target.registry);
-        if (!('manifest' in remote)) {
-            // The fact, and nothing past it. The remedy for a private registry is three
-            // lines in a workflow — `setup-node` with `registry-url`, a scope, and
-            // `NODE_AUTH_TOKEN`, because npm reads the token through a reference in
-            // `.npmrc` — and instructions that do not fit cannot be followed. They
-            // belong on the check's page, which the report already links to.
-            //
-            // The package name is left out on purpose: the reader owns it. The host is
-            // not, because it is the one part they cannot infer — and the difference
-            // between "we asked the wrong registry" and "we were refused" is exactly
-            // what this row got wrong before.
-            // Named only when we know it. Without `publishConfig.registry` npm used
-            // whatever the client's own config points at, and we do not know what that
-            // was — "at the registry" would be filler dressed up as information.
-            const host = target.registry ? new URL(target.registry).host : null;
-            const at = host ? ` at ${host}` : '';
-            const reason = {
-                absent: `nothing published under this name${at} yet`,
-                unauthenticated: `no credentials for ${host ?? 'the registry'}`,
-                unreadable: `could not read the published version${at}`,
-            }[remote.failure];
-            return skip(reason);
-        }
-        const previous = remote.manifest;
-        const delta = current.unpackedSize - previous.unpackedSize;
-        const growth = previous.unpackedSize > 0 ? (delta / previous.unpackedSize) * 100 : 0;
-        const summary = `${mb(previous.unpackedSize)} → ${mb(current.unpackedSize)} ` +
-            `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${previous.version}`;
-        if (growth <= maxGrowth) {
-            logger.info(`[Package Size]: ✅ ${summary}`);
-            return pass(summary);
-        }
-        logSample('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
-        return warn(summary);
-    },
-};
+export function createPackageSizeCheck(pack = packManifest) {
+    return {
+        name: 'Package Size',
+        phase: 'informational',
+        weight: 'heavy',
+        applies(ctx) {
+            if (ctx.config.packageSize?.enabled === false)
+                return false;
+            // A private package is never published, so there is nothing to compare with
+            // and no consumer to pay for the growth.
+            return published(ctx.cwd) !== null;
+        },
+        async run(ctx) {
+            const target = published(ctx.cwd);
+            if (!target)
+                return skip('no publishable package.json');
+            const tag = ctx.config.packageSize?.compareWith ?? 'latest';
+            const maxGrowth = ctx.config.packageSize?.maxGrowthPercent ?? DEFAULT_MAX_GROWTH;
+            const spec = `${target.name}@${tag}`;
+            const local = await pack(ctx.cwd);
+            if (!('manifest' in local))
+                return skip('npm could not describe this package');
+            const current = local.manifest;
+            // Never a pass: a green row over a comparison that did not happen is the
+            // mistake of ticket 072. And never one reason standing in for three — the
+            // three are different situations for the reader, and only one of them is a
+            // fact about the package rather than about the run.
+            const remote = await pack(ctx.cwd, spec, target.registry);
+            if (!('manifest' in remote)) {
+                // The fact, and nothing past it. The remedy for a private registry is three
+                // lines in a workflow — `setup-node` with `registry-url`, a scope, and
+                // `NODE_AUTH_TOKEN`, because npm reads the token through a reference in
+                // `.npmrc` — and instructions that do not fit cannot be followed. They
+                // belong on the check's page, which the report already links to.
+                //
+                // The package name is left out on purpose: the reader owns it. The host is
+                // not, because it is the one part they cannot infer — and the difference
+                // between "we asked the wrong registry" and "we were refused" is exactly
+                // what this row got wrong before.
+                // Named only when we know it. Without `publishConfig.registry` npm used
+                // whatever the client's own config points at, and we do not know what that
+                // was — "at the registry" would be filler dressed up as information.
+                const host = target.registry ? new URL(target.registry).host : null;
+                const at = host ? ` at ${host}` : '';
+                const reason = {
+                    absent: `nothing published under this name${at} yet`,
+                    unauthenticated: `no credentials for ${host ?? 'the registry'}`,
+                    unreadable: `could not read the published version${at}`,
+                }[remote.failure];
+                return skip(reason);
+            }
+            const previous = remote.manifest;
+            const delta = current.unpackedSize - previous.unpackedSize;
+            const growth = previous.unpackedSize > 0 ? (delta / previous.unpackedSize) * 100 : 0;
+            const summary = `${mb(previous.unpackedSize)} → ${mb(current.unpackedSize)} ` +
+                `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${previous.version}`;
+            if (growth <= maxGrowth) {
+                logger.info(`[Package Size]: ✅ ${summary}`);
+                return pass(summary);
+            }
+            logSample('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
+            return warn(summary);
+        },
+    };
+}
+export const packageSizeCheck = createPackageSizeCheck();

package/install-manifests/core/package-lock.json

@@ -11,7 +11,7 @@
         "execa": "9.6.1",
         "yaml": "2.9.1",
         "inquirer": "14.2.2",
-        "gitleaks-secret-scanner-fixed": "3.0.4"
+        "gitleaks-secret-scanner-fixed": "3.0.6"
       }
     },
     "node_modules/@inquirer/ansi": {
@@ -573,15 +573,15 @@
       }
     },
     "node_modules/gitleaks-secret-scanner-fixed": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/gitleaks-secret-scanner-fixed/-/gitleaks-secret-scanner-fixed-3.0.4.tgz",
-      "integrity": "sha512-UxNQSWIcSIux7M6Ue/pcEDz+E/UQVicvpoa/a5TCq6PD32B3sSNe3WY7wIpiyddpJIUImF2gFkQbWM+wZQrKFQ==",
+      "version": "3.0.6",
+      "resolved": "https://registry.npmjs.org/gitleaks-secret-scanner-fixed/-/gitleaks-secret-scanner-fixed-3.0.6.tgz",
+      "integrity": "sha512-qW7JSjmuuPGZxn3b6QUu2etB7i5b1xl6Mx6KFodqzw+C4NYifP4YKW0dtKuwc1YYJAI/h3fEM0EftSwFjxy57A==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
         "fs-extra": "^11.2.0",
         "tar": "^7.5.22",
-        "toml": "^5.0.0",
+        "toml": "^5.0.1",
         "unzipper": "^0.12.3"
       },
       "bin": {

package/install-manifests/core/package.json

@@ -5,7 +5,7 @@
     "execa": "9.6.1",
     "yaml": "2.9.1",
     "inquirer": "14.2.2",
-    "gitleaks-secret-scanner-fixed": "3.0.4"
+    "gitleaks-secret-scanner-fixed": "3.0.6"
   },
   "private": true
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "4.1.0",
+    "version": "4.1.1",
     "description": "Security-first PR gate for CI: secret scanning, grype dependency scanning, SBOM — plus linting and formatting across 11 languages",
     "keywords": [
         "github-actions",
@@ -57,7 +57,7 @@
         "lint": "eslint \"src/**/*.{ts,tsx}\" \"tests/**/*.{ts,tsx}\" --fix",
         "prettier": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,md}\" \"tests/**/*.{ts,tsx}\"",
         "spellcheck": "cspell '**/*.{ts,tsx,js,jsx,md,json}' --no-progress",
-        "docs": "typedoc",
+        "docs": "patch-package && typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
         "test": "node --require ./scripts/ts-node-nodenext-resolve.cjs --require ts-node/register --test --test-timeout=60000 \"tests/**/*.test.ts\"",
         "test:ci": "bash scripts/test-per-file.sh",
@@ -83,7 +83,7 @@
     "license": "LicenseRef-PR-Checkmate-Proprietary",
     "dependencies": {
         "execa": "^9.6.0",
-        "gitleaks-secret-scanner-fixed": "3.0.4",
+        "gitleaks-secret-scanner-fixed": "3.0.6",
         "inquirer": "^14.1.0",
         "yaml": "^2.9.0"
     },
@@ -110,6 +110,7 @@
         "knip": "^6.32.2",
         "license-checker-rseidelsohn": "^5.0.1",
         "markdownlint": "^0.41.1",
+        "patch-package": "^8.0.1",
         "prettier": "^3.9.6",
         "pyright": "^1.1.413",
         "standard-version": "^9.5.0",