prodlint 0.9.5 → 0.10.0

package/action.yml

@@ -1,152 +1,152 @@
-name: 'Prodlint'
-description: 'Production readiness for vibe-coded apps — check your AI code before you ship'
-branding:
-  icon: 'shield'
-  color: 'green'
-
-inputs:
-  path:
-    description: 'Path to scan (default: current directory)'
-    required: false
-    default: '.'
-  threshold:
-    description: 'Minimum score to pass (0-100). Fails the check if score is below this.'
-    required: false
-    default: '0'
-  ignore:
-    description: 'Glob patterns to ignore (comma-separated)'
-    required: false
-    default: ''
-  comment:
-    description: 'Post a PR comment with results (true/false)'
-    required: false
-    default: 'true'
-
-outputs:
-  score:
-    description: 'Overall prodlint score (0-100)'
-    value: ${{ steps.scan.outputs.score }}
-  critical:
-    description: 'Number of critical findings'
-    value: ${{ steps.scan.outputs.critical }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Setup Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '20'
-
-    - name: Run prodlint
-      id: scan
-      shell: bash
-      env:
-        INPUT_PATH: ${{ inputs.path }}
-        INPUT_IGNORE: ${{ inputs.ignore }}
-      run: |
-        CMD_ARGS=("$INPUT_PATH" "--json")
-        if [ -n "$INPUT_IGNORE" ]; then
-          IFS=',' read -ra PATTERNS <<< "$INPUT_IGNORE"
-          for p in "${PATTERNS[@]}"; do
-            trimmed=$(echo "$p" | xargs)
-            CMD_ARGS+=("--ignore" "$trimmed")
-          done
-        fi
-
-        OUTPUT=$(npx -y prodlint@latest "${CMD_ARGS[@]}" 2>&1) || true
-
-        SCORE=$(echo "$OUTPUT" | node -e "
-          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-          console.log(Number(d.overallScore) || 0);
-        " 2>/dev/null || echo "0")
-        SCORE=$(echo "$SCORE" | tr -cd '0-9')
-
-        CRITICAL=$(echo "$OUTPUT" | node -e "
-          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-          console.log(Number(d.summary.critical) || 0);
-        " 2>/dev/null || echo "0")
-        CRITICAL=$(echo "$CRITICAL" | tr -cd '0-9')
-
-        echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
-        echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
-        echo "$OUTPUT" > /tmp/prodlint-result.json
-
-    - name: Generate comment body
-      if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      id: comment
-      shell: bash
-      env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
-        INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-
-        if [ "$SCORE" -ge 80 ]; then
-          EMOJI="✅"
-          COLOR="brightgreen"
-        elif [ "$SCORE" -ge 60 ]; then
-          EMOJI="⚠️"
-          COLOR="yellow"
-        else
-          EMOJI="🚨"
-          COLOR="red"
-        fi
-
-        # Build comment from JSON with markdown sanitization
-        TMPFILE=$(mktemp "${RUNNER_TEMP:-/tmp}/prodlint-comment-XXXXXX.md")
-        node -e "
-          const fs = require('fs');
-          const d = JSON.parse(fs.readFileSync('/tmp/prodlint-result.json', 'utf8'));
-          const esc = s => String(s).replace(/[[\]()\\*_\`<>]/g, c => '\\\\' + c);
-          const lines = [];
-          lines.push('## ' + '$EMOJI' + ' Production Readiness: **' + d.overallScore + '/100**');
-          lines.push('');
-          lines.push('| Category | Score | Issues |');
-          lines.push('|----------|-------|--------|');
-          for (const c of d.categoryScores) {
-            const icon = c.score >= 80 ? '🟢' : c.score >= 60 ? '🟡' : '🔴';
-            lines.push('| ' + icon + ' ' + esc(c.category) + ' | ' + c.score + '/100 | ' + c.findingCount + ' |');
-          }
-          if (d.summary.critical > 0) {
-            lines.push('');
-            lines.push('### Critical Issues');
-            lines.push('');
-            const crits = d.findings.filter(f => f.severity === 'critical');
-            for (const f of crits.slice(0, 10)) {
-              lines.push('- \`' + esc(f.ruleId) + '\` \`' + esc(f.file) + ':' + f.line + '\` — ' + esc(f.message));
-            }
-            if (crits.length > 10) {
-              lines.push('- ...and ' + (crits.length - 10) + ' more');
-            }
-          }
-          lines.push('');
-          lines.push('---');
-          lines.push('*Scanned ' + d.filesScanned + ' files in ' + d.scanDurationMs + 'ms · [prodlint](https://prodlint.com)*');
-          fs.writeFileSync('$TMPFILE', lines.join('\n'));
-        "
-
-        # Use the generated file for the comment step
-        cp "$TMPFILE" /tmp/prodlint-comment.md
-
-    - name: Post PR comment
-      if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      uses: marocchino/sticky-pull-request-comment@v3
-      with:
-        header: prodlint
-        path: /tmp/prodlint-comment.md
-
-    - name: Check threshold
-      if: inputs.threshold != '0'
-      shell: bash
-      env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
-        INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-        if [ "$SCORE" -lt "$THRESHOLD" ]; then
-          echo "::error::Prodlint score ($SCORE) is below threshold ($THRESHOLD)"
-          exit 1
-        fi
+name: 'Prodlint'
+description: 'Production readiness for vibe-coded apps — check your AI code before you ship'
+branding:
+  icon: 'shield'
+  color: 'green'
+
+inputs:
+  path:
+    description: 'Path to scan (default: current directory)'
+    required: false
+    default: '.'
+  threshold:
+    description: 'Minimum score to pass (0-100). Fails the check if score is below this.'
+    required: false
+    default: '0'
+  ignore:
+    description: 'Glob patterns to ignore (comma-separated)'
+    required: false
+    default: ''
+  comment:
+    description: 'Post a PR comment with results (true/false)'
+    required: false
+    default: 'true'
+
+outputs:
+  score:
+    description: 'Overall prodlint score (0-100)'
+    value: ${{ steps.scan.outputs.score }}
+  critical:
+    description: 'Number of critical findings'
+    value: ${{ steps.scan.outputs.critical }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Run prodlint
+      id: scan
+      shell: bash
+      env:
+        INPUT_PATH: ${{ inputs.path }}
+        INPUT_IGNORE: ${{ inputs.ignore }}
+      run: |
+        CMD_ARGS=("$INPUT_PATH" "--json")
+        if [ -n "$INPUT_IGNORE" ]; then
+          IFS=',' read -ra PATTERNS <<< "$INPUT_IGNORE"
+          for p in "${PATTERNS[@]}"; do
+            trimmed=$(echo "$p" | xargs)
+            CMD_ARGS+=("--ignore" "$trimmed")
+          done
+        fi
+
+        OUTPUT=$(npx -y prodlint@latest "${CMD_ARGS[@]}" 2>&1) || true
+
+        SCORE=$(echo "$OUTPUT" | node -e "
+          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+          console.log(Number(d.overallScore) || 0);
+        " 2>/dev/null || echo "0")
+        SCORE=$(echo "$SCORE" | tr -cd '0-9')
+
+        CRITICAL=$(echo "$OUTPUT" | node -e "
+          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+          console.log(Number(d.summary.critical) || 0);
+        " 2>/dev/null || echo "0")
+        CRITICAL=$(echo "$CRITICAL" | tr -cd '0-9')
+
+        echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
+        echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
+        echo "$OUTPUT" > /tmp/prodlint-result.json
+
+    - name: Generate comment body
+      if: inputs.comment == 'true' && github.event_name == 'pull_request'
+      id: comment
+      shell: bash
+      env:
+        SCAN_SCORE: ${{ steps.scan.outputs.score }}
+        INPUT_THRESHOLD: ${{ inputs.threshold }}
+      run: |
+        SCORE="$SCAN_SCORE"
+        THRESHOLD="$INPUT_THRESHOLD"
+
+        if [ "$SCORE" -ge 80 ]; then
+          EMOJI="✅"
+          COLOR="brightgreen"
+        elif [ "$SCORE" -ge 60 ]; then
+          EMOJI="⚠️"
+          COLOR="yellow"
+        else
+          EMOJI="🚨"
+          COLOR="red"
+        fi
+
+        # Build comment from JSON with markdown sanitization
+        TMPFILE=$(mktemp "${RUNNER_TEMP:-/tmp}/prodlint-comment-XXXXXX.md")
+        node -e "
+          const fs = require('fs');
+          const d = JSON.parse(fs.readFileSync('/tmp/prodlint-result.json', 'utf8'));
+          const esc = s => String(s).replace(/[[\]()\\*_\`<>]/g, c => '\\\\' + c);
+          const lines = [];
+          lines.push('## ' + '$EMOJI' + ' Production Readiness: **' + d.overallScore + '/100**');
+          lines.push('');
+          lines.push('| Category | Score | Issues |');
+          lines.push('|----------|-------|--------|');
+          for (const c of d.categoryScores) {
+            const icon = c.score >= 80 ? '🟢' : c.score >= 60 ? '🟡' : '🔴';
+            lines.push('| ' + icon + ' ' + esc(c.category) + ' | ' + c.score + '/100 | ' + c.findingCount + ' |');
+          }
+          if (d.summary.critical > 0) {
+            lines.push('');
+            lines.push('### Critical Issues');
+            lines.push('');
+            const crits = d.findings.filter(f => f.severity === 'critical');
+            for (const f of crits.slice(0, 10)) {
+              lines.push('- \`' + esc(f.ruleId) + '\` \`' + esc(f.file) + ':' + f.line + '\` — ' + esc(f.message));
+            }
+            if (crits.length > 10) {
+              lines.push('- ...and ' + (crits.length - 10) + ' more');
+            }
+          }
+          lines.push('');
+          lines.push('---');
+          lines.push('*Scanned ' + d.filesScanned + ' files in ' + d.scanDurationMs + 'ms · [prodlint](https://prodlint.com)*');
+          fs.writeFileSync('$TMPFILE', lines.join('\n'));
+        "
+
+        # Use the generated file for the comment step
+        cp "$TMPFILE" /tmp/prodlint-comment.md
+
+    - name: Post PR comment
+      if: inputs.comment == 'true' && github.event_name == 'pull_request'
+      uses: marocchino/sticky-pull-request-comment@v3
+      with:
+        header: prodlint
+        path: /tmp/prodlint-comment.md
+
+    - name: Check threshold
+      if: inputs.threshold != '0'
+      shell: bash
+      env:
+        SCAN_SCORE: ${{ steps.scan.outputs.score }}
+        INPUT_THRESHOLD: ${{ inputs.threshold }}
+      run: |
+        SCORE="$SCAN_SCORE"
+        THRESHOLD="$INPUT_THRESHOLD"
+        if [ "$SCORE" -lt "$THRESHOLD" ]; then
+          echo "::error::Prodlint score ($SCORE) is below threshold ($THRESHOLD)"
+          exit 1
+        fi

package/dist/cli.js

@@ -522,6 +522,33 @@ async function collectWorkspaceDependencies(root, patterns) {
   }
   return deps;
 }
+async function collectNestedPackageDependencies(root) {
+  const deps = /* @__PURE__ */ new Set();
+  try {
+    const pkgFiles = await fg(["**/package.json"], {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**", "package.json"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -549,6 +576,10 @@ async function buildProjectContext(root, files) {
       declaredDependencies.add(dep);
     }
   }
+  const nestedDeps = await collectNestedPackageDependencies(root);
+  for (const dep of nestedDeps) {
+    declaredDependencies.add(dep);
+  }
   for (const dep of declaredDependencies) {
     const framework = DEPENDENCY_TO_FRAMEWORK[dep];
     if (framework) {

package/dist/index.js

@@ -516,6 +516,33 @@ async function collectWorkspaceDependencies(root, patterns) {
   }
   return deps;
 }
+async function collectNestedPackageDependencies(root) {
+  const deps = /* @__PURE__ */ new Set();
+  try {
+    const pkgFiles = await fg(["**/package.json"], {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**", "package.json"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -543,6 +570,10 @@ async function buildProjectContext(root, files) {
       declaredDependencies.add(dep);
     }
   }
+  const nestedDeps = await collectNestedPackageDependencies(root);
+  for (const dep of nestedDeps) {
+    declaredDependencies.add(dep);
+  }
   for (const dep of declaredDependencies) {
     const framework = DEPENDENCY_TO_FRAMEWORK[dep];
     if (framework) {

package/dist/mcp.js

@@ -525,6 +525,33 @@ async function collectWorkspaceDependencies(root, patterns) {
   }
   return deps;
 }
+async function collectNestedPackageDependencies(root) {
+  const deps = /* @__PURE__ */ new Set();
+  try {
+    const pkgFiles = await fg(["**/package.json"], {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**", "package.json"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -552,6 +579,10 @@ async function buildProjectContext(root, files) {
       declaredDependencies.add(dep);
     }
   }
+  const nestedDeps = await collectNestedPackageDependencies(root);
+  for (const dep of nestedDeps) {
+    declaredDependencies.add(dep);
+  }
   for (const dep of declaredDependencies) {
     const framework = DEPENDENCY_TO_FRAMEWORK[dep];
     if (framework) {

package/package.json

@@ -1,97 +1,97 @@
-{
-  "name": "prodlint",
-  "version": "0.9.5",
-  "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
-  "license": "MIT",
-  "author": "prodlint contributors",
-  "type": "module",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/prodlint/prodlint"
-  },
-  "bugs": {
-    "url": "https://github.com/prodlint/prodlint/issues"
-  },
-  "homepage": "https://prodlint.com",
-  "mcpName": "io.github.prodlint/prodlint",
-  "bin": {
-    "prodlint": "./dist/cli.js",
-    "prodlint-mcp": "./dist/mcp.js"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    },
-    "./mcp": {
-      "import": "./dist/mcp.js"
-    }
-  },
-  "files": [
-    "dist/**/*.js",
-    "dist/**/*.d.ts",
-    "action.yml"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "lint": "node dist/cli.js .",
-    "audit:supply-chain": "node scripts/supply-chain-audit.cjs",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@babel/parser": "^7.29.7",
-    "@babel/types": "^7.29.7",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "fast-glob": "^3.3.3",
-    "picocolors": "^1.1.1",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@types/node": "^26.0.1",
-    "tsup": "^8.4.0",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.6"
-  },
-  "optionalDependencies": {
-    "@rollup/rollup-win32-x64-msvc": "^4.62.2"
-  },
-  "overrides": {
-    "esbuild": "^0.28.1"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "lint",
-    "linter",
-    "security",
-    "ai",
-    "ai-code",
-    "vibe-coding",
-    "production-readiness",
-    "code-quality",
-    "code-scanner",
-    "next.js",
-    "react",
-    "typescript",
-    "static-analysis",
-    "cli",
-    "scanner",
-    "mcp",
-    "mcp-server",
-    "cursor",
-    "copilot",
-    "v0",
-    "bolt",
-    "windsurf",
-    "claude",
-    "github-action",
-    "eslint-alternative",
-    "devtools"
-  ]
-}
+{
+  "name": "prodlint",
+  "version": "0.10.0",
+  "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
+  "license": "MIT",
+  "author": "prodlint contributors",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/prodlint/prodlint"
+  },
+  "bugs": {
+    "url": "https://github.com/prodlint/prodlint/issues"
+  },
+  "homepage": "https://prodlint.com",
+  "mcpName": "io.github.prodlint/prodlint",
+  "bin": {
+    "prodlint": "./dist/cli.js",
+    "prodlint-mcp": "./dist/mcp.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./mcp": {
+      "import": "./dist/mcp.js"
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "action.yml"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "node dist/cli.js .",
+    "audit:supply-chain": "node scripts/supply-chain-audit.cjs",
+    "verify:release": "node scripts/verify-release.cjs",
+    "sync:versions": "node scripts/sync-versions.cjs",
+    "version": "node scripts/sync-versions.cjs",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.29.7",
+    "@babel/types": "^7.29.7",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "fast-glob": "^3.3.3",
+    "picocolors": "^1.1.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.2",
+    "tsup": "^8.4.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "lint",
+    "linter",
+    "security",
+    "ai",
+    "ai-code",
+    "vibe-coding",
+    "production-readiness",
+    "code-quality",
+    "code-scanner",
+    "next.js",
+    "react",
+    "typescript",
+    "static-analysis",
+    "cli",
+    "scanner",
+    "mcp",
+    "mcp-server",
+    "cursor",
+    "copilot",
+    "v0",
+    "bolt",
+    "windsurf",
+    "claude",
+    "github-action",
+    "eslint-alternative",
+    "devtools"
+  ]
+}