react-doctor 0.2.11-dev.f036b0f → 0.2.11-dev.f4035fc

package/README.md

@@ -43,6 +43,32 @@ Works with Claude Code, Cursor, Codex, OpenCode, and many more.
 
 Add the reusable GitHub Action from Marketplace to scan every pull request, show inline annotations, and leave findings where reviewers already look.
 
+```yaml
+name: React Doctor
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: react-doctor-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  react-doctor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: millionco/react-doctor@v1
+```
+
+React Doctor scans the files changed in the pull request, emits inline annotations, blocks on error-level findings, and updates one sticky PR comment with the score and issue summary. The built-in GitHub token is used automatically; no secret or PAT is required. On forked PRs where GitHub withholds write permissions, the scan and annotations still run, but the sticky comment may be skipped.
+
 [Add GitHub Action →](https://github.com/marketplace/actions/react-doctor)
 
 ## Contributing

package/dist/cli.js

@@ -3,7 +3,7 @@ import { A as isReactDoctorError, C as filterSourceFiles, D as groupBy, E as get
 import { createRequire } from "node:module";
 import { execFileSync, execSync } from "node:child_process";
 import path, { join } from "node:path";
-import { accessSync, chmodSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, rmdirSync, statSync, writeFileSync } from "node:fs";
+import fs, { accessSync, chmodSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, rmdirSync, statSync, writeFileSync } from "node:fs";
 import process$1 from "node:process";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -6666,7 +6666,7 @@ const resolveOxlintNodeEffect = (isLintEnabled, isQuiet) => Effect.gen(function*
 const resolveOxlintNode = (isLintEnabled, isQuiet) => Effect.runPromise(resolveOxlintNodeEffect(isLintEnabled, isQuiet).pipe(Effect.provide(NodeResolver.layerNode)));
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.2.11-dev.f036b0f";
+const VERSION = "0.2.11-dev.f4035fc";
 //#endregion
 //#region src/inspect.ts
 const silentConsole = makeNoopConsole();
@@ -7153,6 +7153,29 @@ const promptCopyIssues = async (input) => {
 	else cliLogger.log(issuesSummary);
 };
 //#endregion
+//#region src/cli/utils/path-format.ts
+const toForwardSlashes = (filePath) => filePath.replaceAll("\\", "/");
+//#endregion
+//#region src/cli/utils/read-changed-files-from.ts
+const isSafeRelativePath = (filePath) => {
+	if (filePath.length === 0) return false;
+	if (filePath.includes("\0")) return false;
+	if (path.isAbsolute(filePath)) return false;
+	const normalized = path.posix.normalize(filePath);
+	if (normalized === "." || normalized.startsWith("../") || normalized === "..") return false;
+	return normalized === filePath;
+};
+const readChangedFilesFrom = (filePath) => {
+	const raw = fs.readFileSync(filePath, "utf8");
+	const uniqueFiles = /* @__PURE__ */ new Set();
+	for (const line of raw.split(/\r?\n/)) {
+		const candidate = toForwardSlashes(line.trim());
+		if (!isSafeRelativePath(candidate)) continue;
+		uniqueFiles.add(candidate);
+	}
+	return [...uniqueFiles];
+};
+//#endregion
 //#region src/cli/utils/render-multi-project-summary.ts
 const SUMMARY_BAR_WIDTH_CHARS = 20;
 const buildMiniBar = (score) => {
@@ -7611,7 +7634,6 @@ const resolveFailOnLevel = (flags, userConfig) => {
 };
 //#endregion
 //#region src/cli/utils/resolve-project-diff-include-paths.ts
-const toForwardSlashes = (filePath) => filePath.replaceAll("\\", "/");
 const resolveProjectDiffIncludePaths = (rootDirectory, projectDirectory, diffInfo) => {
 	const changedSourceFiles = filterSourceFiles(diffInfo.changedFiles);
 	const relativeProjectDirectory = toForwardSlashes(path.relative(rootDirectory, projectDirectory));
@@ -7810,7 +7832,7 @@ const validateModeFlags = (flags) => {
 	if (flags.yes && flags.full) throw new Error("Cannot combine --yes and --full; pick one.");
 	if (flags.score && flags.json) throw new Error("Cannot combine --score and --json; pick one output mode.");
 	if (flags.prComment && (flags.json || flags.score)) throw new Error("--pr-comment cannot be combined with --json or --score.");
-	if (flags.annotations && (flags.json || flags.score)) throw new Error("--annotations cannot be combined with --json or --score.");
+	if (flags.annotations && flags.score) throw new Error("--annotations cannot be combined with --score.");
 	if (flags.explain !== void 0 && flags.why !== void 0) throw new Error("Use --explain or --why, not both — they're aliases of the same flag.");
 	if ((flags.explain ?? flags.why) !== void 0 && (flags.json || flags.score || flags.annotations || flags.staged)) throw new Error("--explain cannot be combined with --json, --score, --annotations, or --staged.");
 };
@@ -7836,6 +7858,12 @@ const finalizeScans = (input) => {
 	const ciFailureDiagnostics = filterDiagnosticsForSurface(input.diagnostics, "ciFailure", input.userConfig);
 	if (!input.isScoreOnly && shouldFailForDiagnostics(ciFailureDiagnostics, resolveFailOnLevel(input.flags, input.userConfig))) process.exitCode = 1;
 };
+const buildChangedFilesDiffInfo = (changedFiles) => ({
+	currentBranch: process.env.GITHUB_HEAD_REF?.trim() || null,
+	baseBranch: process.env.GITHUB_BASE_REF?.trim() || "pull request target",
+	changedFiles,
+	isCurrentChanges: false
+});
 const inspectAction = async (directory, flags) => {
 	const isScoreOnly = Boolean(flags.score);
 	const isJsonMode = Boolean(flags.json);
@@ -7938,9 +7966,10 @@ const inspectAction = async (directory, flags) => {
 			return;
 		}
 		const projectDirectories = await selectProjects(resolvedDirectory, flags.project, skipPrompts);
+		const changedFilesDiffInfo = flags.changedFilesFrom && !flags.full ? buildChangedFilesDiffInfo(readChangedFilesFrom(path.resolve(flags.changedFilesFrom))) : null;
 		const effectiveDiff = resolveEffectiveDiff(flags, userConfig);
-		const diffInfo = effectiveDiff !== void 0 && effectiveDiff !== false || !skipPrompts && !isQuiet ? await getDiffInfo(resolvedDirectory, typeof effectiveDiff === "string" ? effectiveDiff : void 0) : null;
-		const isDiffMode = await resolveDiffMode(diffInfo, effectiveDiff, skipPrompts, isQuiet);
+		const diffInfo = changedFilesDiffInfo ?? (changedFilesDiffInfo === null && (effectiveDiff !== void 0 && effectiveDiff !== false || !skipPrompts && !isQuiet) ? await getDiffInfo(resolvedDirectory, typeof effectiveDiff === "string" ? effectiveDiff : void 0) : null);
+		const isDiffMode = changedFilesDiffInfo !== null || await resolveDiffMode(diffInfo, effectiveDiff, skipPrompts, isQuiet);
 		setJsonReportMode(isDiffMode ? "diff" : "full");
 		if (isDiffMode && diffInfo && !isQuiet) {
 			if (diffInfo.isCurrentChanges) cliLogger.log("Scanning uncommitted changes");
@@ -8838,21 +8867,23 @@ const buildWorkflowContent = () => [
 	"",
 	"on:",
 	"  pull_request:",
-	"    branches: [main]",
+	"    types: [opened, synchronize, reopened, ready_for_review]",
 	"",
 	"permissions:",
 	"  contents: read",
 	"  pull-requests: write",
+	"  issues: write",
+	"",
+	"concurrency:",
+	"  group: react-doctor-${{ github.event.pull_request.number || github.ref }}",
+	"  cancel-in-progress: true",
 	"",
 	"jobs:",
 	"  react-doctor:",
 	"    runs-on: ubuntu-latest",
 	"    steps:",
-	"      - uses: actions/checkout@v4",
-	"      - uses: millionco/react-doctor@main",
-	"        with:",
-	"          github-token: ${{ secrets.GITHUB_TOKEN }}",
-	"          diff: main",
+	"      - uses: actions/checkout@v5",
+	"      - uses: millionco/react-doctor@v1",
 	""
 ].join("\n");
 const runInstallReactDoctor = async (options = {}) => {
@@ -9050,6 +9081,7 @@ const ROOT_FLAG_SPEC = {
 		"--yes"
 	]),
 	longOptionsWithRequiredValues: new Set([
+		"--changed-files-from",
 		"--explain",
 		"--fail-on",
 		"--project",
@@ -9143,10 +9175,16 @@ const stripUnknownCliFlags = (argv) => {
 	];
 };
 //#endregion
+//#region src/cli/utils/unref-stdin.ts
+const unrefStdin = () => {
+	process.stdin.unref?.();
+};
+//#endregion
 //#region src/cli/index.ts
 process.on("SIGINT", exitGracefully);
 process.on("SIGTERM", exitGracefully);
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("-y, --yes", "skip prompts, scan all workspace projects").option("--full", "force a full scan (overrides any `diff` value in config or `--diff`)").option("--project <name>", "select workspace project (comma-separated for multiple)").option("--diff [base]", "scan only files changed vs base branch (pass `false` to disable; overridden by --full)").option("--no-score", "skip the score API and the share URL").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--fail-on <level>", "exit with error code on diagnostics: error, warning, none (default: none)").option("--annotations", "output diagnostics as GitHub Actions annotations").option("--pr-comment", "tune CLI output for sticky PR comments (drops weak-signal rule families like `design` from the printed list and the fail-on gate; configure via config.surfaces)").option("--explain <file:line>", "diagnose why a rule fired or why a suppression didn't apply at a specific location").option("--why <file:line>", "alias for --explain").option("--respect-inline-disables", "respect inline `// eslint-disable*` / `// oxlint-disable*` comments (default)").option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").addHelpText("after", `
+unrefStdin();
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("-y, --yes", "skip prompts, scan all workspace projects").option("--full", "force a full scan (overrides any `diff` value in config or `--diff`)").option("--project <name>", "select workspace project (comma-separated for multiple)").option("--diff [base]", "scan only files changed vs base branch (pass `false` to disable; overridden by --full)").option("--changed-files-from <file>", "internal: scan source files listed in a newline-delimited changed-files file").option("--no-score", "skip the score API and the share URL").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--fail-on <level>", "exit with error code on diagnostics: error, warning, none (default: none)").option("--annotations", "output diagnostics as GitHub Actions annotations").option("--pr-comment", "tune CLI output for sticky PR comments (drops weak-signal rule families like `design` from the printed list and the fail-on gate; configure via config.surfaces)").option("--explain <file:line>", "diagnose why a rule fired or why a suppression didn't apply at a specific location").option("--why <file:line>", "alias for --explain").option("--respect-inline-disables", "respect inline `// eslint-disable*` / `// oxlint-disable*` comments (default)").option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").addHelpText("after", `
 ${highlighter.dim("Configuration:")}
   Place a ${highlighter.info("react-doctor.config.json")} (or ${highlighter.info("\"reactDoctor\"")} key in your package.json) in the project root.
   CLI flags always override config values. See the README for the full schema.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-doctor",
-  "version": "0.2.11-dev.f036b0f",
+  "version": "0.2.11-dev.f4035fc",
   "description": "Diagnose and fix React codebases for security, performance, correctness, accessibility, bundle-size, and architecture issues",
   "keywords": [
     "accessibility",
@@ -58,14 +58,14 @@
     "oxlint": "^1.66.0",
     "prompts": "^2.4.2",
     "typescript": ">=5.0.4 <7",
-    "oxlint-plugin-react-doctor": "0.2.11-dev.f036b0f"
+    "oxlint-plugin-react-doctor": "0.2.11-dev.f4035fc"
   },
   "devDependencies": {
     "@types/prompts": "^2.4.9",
     "commander": "^14.0.3",
     "ora": "^9.4.0",
-    "@react-doctor/api": "0.2.11",
-    "@react-doctor/core": "0.2.11"
+    "@react-doctor/core": "0.2.11",
+    "@react-doctor/api": "0.2.11"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"