react-native-doctor-ci 0.1.0 → 0.1.1

package/README.md

@@ -1,6 +1,6 @@
 # react-native-doctor-ci
 
-Fail pull requests that add abandoned, non-New-Architecture, or npm-deprecated React Native dependencies — with inline annotations and a policy-as-code allowlist.
+Fail pull requests that add abandoned, non-New-Architecture, or npm-deprecated React Native dependencies — with inline annotations and a policy-as-code allowlist.
 
 ![PR annotation: rn-doctor fails a pull request on the exact package.json line that adds a dying dependency](https://raw.githubusercontent.com/AmrithVengalath/react-native-doctor-ci/main/docs/assets/pr-annotation.png)
 
@@ -11,9 +11,9 @@ Fail pull requests that add abandoned, non-New-Architecture, or npm-deprecated R
 
 ## Why
 
-Unmaintained dependencies are a perennial top-5 pain in React Native surveys, and the cost keeps climbing now that the New Architecture is the default: a package that looked fine when it was added quietly stops getting releases, never gains New Architecture support, or gets deprecated on npm — and you find out during an upgrade, months after the PR that introduced it merged.
+Unmaintained dependencies are a perennial top-5 pain in React Native surveys, and the cost keeps climbing now that the New Architecture is the default: a package that looked fine when it was added quietly stops getting releases, never gains New Architecture support, or gets deprecated on npm — and you find out during an upgrade, months after the PR that introduced it merged.
 
-Lookup tools exist (the React Native Directory tells you a package's status if you go ask). What's been missing is **enforcement**: the check that runs on every PR, fails when someone adds a dying dependency, and points at the exact line — so the conversation happens at review time, when swapping the package costs five minutes instead of a quarter.
+Lookup tools exist (the React Native Directory tells you a package's status if you go ask). What's been missing is **enforcement**: the check that runs on every PR, fails when someone adds a dying dependency, and points at the exact line — so the conversation happens at review time, when swapping the package costs five minutes instead of a quarter.
 
 `rn-doctor` is that check. Pure TypeScript, zero native code, one command.
 
@@ -40,7 +40,7 @@ jobs:
         with:
           fetch-depth: 0 # required for changed-only (merge-base diff)
 
-      - uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.0
+      - uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.1
         with:
           changed-only: "true"
           base: origin/${{ github.base_ref }}
@@ -61,7 +61,7 @@ npx --yes --package react-native-doctor-ci rn-doctor
 ## GitHub Action reference
 
 ```yaml
-- uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.0
+- uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.1
   with:
     version: "0.1.0"          # npm version/dist-tag to run (default: latest)
     policy: ".rn-doctor.yml"  # policy file path (default: auto-detect)
@@ -76,8 +76,8 @@ npx --yes --package react-native-doctor-ci rn-doctor
 
 Notes:
 
-- `changed-only` requires `actions/checkout` with `fetch-depth: 0` — the diff is computed against the merge-base of the PR branch and `base`, same as GitHub's three-dot compare. Without history the run fails with an actionable message telling you exactly that.
-- The default `token` (the workflow's own `GITHUB_TOKEN`) is enough; it's only used to read public repo metadata (archived state, last push). Without any token those fields degrade to `unknown` with a warning — the run never fails because of rate limits.
+- `changed-only` requires `actions/checkout` with `fetch-depth: 0` — the diff is computed against the merge-base of the PR branch and `base`, same as GitHub's three-dot compare. Without history the run fails with an actionable message telling you exactly that.
+- The default `token` (the workflow's own `GITHUB_TOKEN`) is enough; it's only used to read public repo metadata (archived state, last push). Without any token those fields degrade to `unknown` with a warning — the run never fails because of rate limits.
 - Pin `version` for reproducible CI; `latest` is convenient but floats.
 
 ## CLI reference
@@ -98,7 +98,7 @@ rn-doctor [options]
   -h, --help         Show help
 ```
 
-**Exit codes** (stable contract — CI depends on it):
+**Exit codes** (stable contract — CI depends on it):
 
 | Code | Meaning |
 | ---- | ------- |
@@ -108,7 +108,7 @@ rn-doctor [options]
 
 **Environment**: `GITHUB_TOKEN` (optional, enables GitHub repo enrichment), `NO_COLOR` (disables ANSI color), `GITHUB_ACTIONS=true` (auto-enables annotations).
 
-Only `dependencies` are checked — `devDependencies` never ship in your app.
+Only `dependencies` are checked — `devDependencies` never ship in your app.
 
 ## Policy: `.rn-doctor.yml`
 
@@ -132,9 +132,9 @@ allow: []                       # see "Unblocking a PR" below
 
 Each rule takes `error | warn | off` (except `lastPublish`, which takes thresholds or `"off"`).
 
-**How the data is gathered.** Each dependency is enriched in parallel from the npm registry (publish time, deprecation, `codegenConfig`), the [React Native Directory](https://reactnative.directory) (New Architecture support, unmaintained flag, GitHub URL), and the GitHub API (archived, last push — token optional). Results are cached in `.rn-doctor-cache.json` for 24 hours (add it to `.gitignore`; `--no-cache` bypasses).
+**How the data is gathered.** Each dependency is enriched in parallel from the npm registry (publish time, deprecation, `codegenConfig`), the [React Native Directory](https://reactnative.directory) (New Architecture support, unmaintained flag, GitHub URL), and the GitHub API (archived, last push — token optional). Results are cached in `.rn-doctor-cache.json` for 24 hours (add it to `.gitignore`; `--no-cache` bypasses).
 
-**New Architecture verdicts** are tiered honestly: directory says supported → pass; directory says unsupported → `newArchitecture` fires; unknown but the package ships `codegenConfig` → pass with an informational note; unknown otherwise → `newArchUnknown` fires (a warning by default — missing data is not the same as a dead package).
+**New Architecture verdicts** are tiered honestly: directory says supported → pass; directory says unsupported → `newArchitecture` fires; unknown but the package ships `codegenConfig` → pass with an informational note; unknown otherwise → `newArchUnknown` fires (a warning by default — missing data is not the same as a dead package).
 
 **Scope.** `rn-native-only` (default) checks packages that actually couple to React Native: listed in the RN Directory, peer-depend on `react-native`, or ship `android`/`ios` directories. `all-deps` checks everything under `dependencies`.
 
@@ -149,14 +149,14 @@ allow:
     expires: 2027-01-31
 ```
 
-- Suppressed findings still appear in output (marked as allowed) — nothing disappears silently.
+- Suppressed findings still appear in output (marked as allowed) — nothing disappears silently.
 - `expires` is optional but recommended: past that date the allow stops suppressing and findings **escalate to errors**, so exceptions can't quietly outlive their justification.
 - Every finding's message suggests the exact allowlist entry to add, so unblocking is copy-paste.
 
 ## Output formats
 
-- **Pretty** (default): one block per finding — severity badge, message, allow-reason if suppressed, and an evidence link (npm/directory/GitHub) so you can verify every claim.
-- **`--json`**: stable-ordered, timestamp-free (`version: 1`) — safe to snapshot or post-process.
+- **Pretty** (default): one block per finding — severity badge, message, allow-reason if suppressed, and an evidence link (npm/directory/GitHub) so you can verify every claim.
+- **`--json`**: stable-ordered, timestamp-free (`version: 1`) — safe to snapshot or post-process.
 - **`--sarif`**: SARIF 2.1.0, validates against the official schema. Upload to GitHub code scanning:
 
   ```yaml
@@ -167,30 +167,30 @@ allow:
       sarif_file: rn-doctor.sarif
   ```
 
-- **GitHub annotations**: emitted automatically inside GitHub Actions, resolved to the dependency's real line in `package.json` (string-escape-aware — a same-named key under `scripts` can't false-match).
+- **GitHub annotations**: emitted automatically inside GitHub Actions, resolved to the dependency's real line in `package.json` (string-escape-aware — a same-named key under `scripts` can't false-match).
 
 ## Changed-only and monorepos
 
-`--changed-only` is the flagship PR mode: it diffs `dependencies` against the merge-base with `--base` and checks only additions and spec changes (downgrades and protocol changes count too — they're re-checked). Fast, and zero noise from pre-existing debt: adopting rn-doctor on a 5-year-old app doesn't mean fixing 30 findings before the check goes green.
+`--changed-only` is the flagship PR mode: it diffs `dependencies` against the merge-base with `--base` and checks only additions and spec changes (downgrades and protocol changes count too — they're re-checked). Fast, and zero noise from pre-existing debt: adopting rn-doctor on a 5-year-old app doesn't mean fixing 30 findings before the check goes green.
 
 `--workspaces` walks npm/yarn `workspaces` globs or `pnpm-workspace.yaml` and checks every workspace manifest, with findings grouped per manifest and annotations pointing at the right file. Composes with `--changed-only`.
 
 ## FAQ
 
-**Does it check devDependencies?** No — they don't ship in your app. Scope decisions live in the policy file, not flags.
+**Does it check devDependencies?** No — they don't ship in your app. Scope decisions live in the policy file, not flags.
 
 **Is it a security scanner?** No. CVE auditing is `npm audit` / OSV territory. rn-doctor answers a different question: *is this dependency alive and does it have a future on the New Architecture?*
 
-**Does it fix anything?** No — it tells you what's wrong and what to do (allowlist entry, `npx expo install --fix`, Renovate), then gets out of the way.
+**Does it fix anything?** No — it tells you what's wrong and what to do (allowlist entry, `npx expo install --fix`, Renovate), then gets out of the way.
 
-**What if the RN Directory is wrong about a package?** Every finding carries an evidence link so you can check, and a false positive costs one allowlist line. File a correction with the directory — everyone benefits.
+**What if the RN Directory is wrong about a package?** Every finding carries an evidence link so you can check, and a false positive costs one allowlist line. File a correction with the directory — everyone benefits.
 
-**Why is `yaml` the only runtime dependency?** The policy file and `pnpm-workspace.yaml` are YAML, and a spec-compliant YAML parser is not a weekend project — this one is worth its weight. Everything else (HTTP, caching, git diffing, glob matching, SARIF, annotations) is hand-rolled on Node built-ins; less supply chain in a tool whose whole job is judging dependencies.
+**Why is `yaml` the only runtime dependency?** The policy file and `pnpm-workspace.yaml` are YAML, and a spec-compliant YAML parser is not a weekend project — this one is worth its weight. Everything else (HTTP, caching, git diffing, glob matching, SARIF, annotations) is hand-rolled on Node built-ins; less supply chain in a tool whose whole job is judging dependencies.
 
 ## Contributing
 
-Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). The project follows a phased roadmap; out-of-scope items (security auditing, auto-fixing, a hosted service) are listed there.
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). The project follows a phased roadmap; out-of-scope items (security auditing, auto-fixing, a hosted service) are listed there.
 
 ## License
 
-[MIT](LICENSE) © Amrith Vengalath
+[MIT](LICENSE) © Amrith Vengalath

package/dist/cli.cjs

@@ -117,6 +117,89 @@ async function mapWithConcurrency(items, fn, concurrency = 8) {
   return results;
 }
 
+// package.json
+var package_default = {
+  name: "react-native-doctor-ci",
+  version: "0.1.1",
+  description: "Policy-as-code CI gate for React Native dependency health: fail PRs that add abandoned, non-New-Architecture, or npm-deprecated dependencies.",
+  keywords: [
+    "react-native",
+    "ci",
+    "dependencies",
+    "new-architecture",
+    "policy",
+    "lint",
+    "github-actions",
+    "sarif"
+  ],
+  license: "MIT",
+  author: "Amrith Vengalath",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/AmrithVengalath/react-native-doctor-ci.git"
+  },
+  homepage: "https://github.com/AmrithVengalath/react-native-doctor-ci#readme",
+  bugs: "https://github.com/AmrithVengalath/react-native-doctor-ci/issues",
+  type: "module",
+  bin: {
+    "rn-doctor": "./dist/cli.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js",
+      require: "./dist/index.cjs"
+    }
+  },
+  main: "./dist/index.cjs",
+  module: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  files: [
+    "dist"
+  ],
+  engines: {
+    node: ">=20"
+  },
+  packageManager: "pnpm@11.11.0",
+  publishConfig: {
+    access: "public",
+    provenance: true
+  },
+  scripts: {
+    typecheck: "tsc --noEmit",
+    lint: "eslint .",
+    "lint:fix": "eslint . --fix",
+    test: "vitest run",
+    "test:watch": "vitest",
+    "test:cov": "vitest run --coverage",
+    build: "tsup",
+    dev: "tsup --watch",
+    prepublishOnly: "pnpm run build",
+    release: "release-it"
+  },
+  devDependencies: {
+    "@eslint/js": "^10.0.1",
+    "@release-it/conventional-changelog": "^11.0.1",
+    "@types/node": "^20.19.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    ajv: "^8.20.0",
+    eslint: "^10.7.0",
+    jiti: "^2.7.0",
+    msw: "^2.15.0",
+    "release-it": "^20.2.1",
+    tsup: "^8.5.1",
+    typescript: "6.0.3",
+    "typescript-eslint": "^8.63.0",
+    vitest: "^4.1.10"
+  },
+  dependencies: {
+    yaml: "^2.9.0"
+  }
+};
+
+// src/version.ts
+var VERSION = package_default.version;
+
 // src/http.ts
 async function fetchJson(url, options = {}) {
   const controller = new AbortController();
@@ -125,7 +208,7 @@ async function fetchJson(url, options = {}) {
   try {
     const response = await fetch(url, {
       headers: {
-        "user-agent": "rn-doctor/0.0.0",
+        "user-agent": `rn-doctor/${VERSION}`,
         ...options.headers
       },
       signal: controller.signal
@@ -1223,9 +1306,6 @@ function renderPretty(report, options) {
 `;
 }
 
-// src/version.ts
-var VERSION = "0.0.0";
-
 // src/report-sarif.ts
 var INFORMATION_URI = "https://www.npmjs.com/package/react-native-doctor-ci";
 var RULE_IDS = [