react-native-doctor-ci 0.1.1 → 0.1.2

package/README.md

@@ -1,6 +1,6 @@
 # react-native-doctor-ci
 
-Fail pull requests that add abandoned, non-New-Architecture, or npm-deprecated React Native dependencies — with inline annotations and a policy-as-code allowlist.
+Fail pull requests that add abandoned, non-New-Architecture, or npm-deprecated React Native dependencies — with inline annotations and a policy-as-code allowlist.
 
 ![PR annotation: rn-doctor fails a pull request on the exact package.json line that adds a dying dependency](https://raw.githubusercontent.com/AmrithVengalath/react-native-doctor-ci/main/docs/assets/pr-annotation.png)
 
@@ -11,9 +11,9 @@ Fail pull requests that add abandoned, non-New-Architecture, or npm-deprecated R
 
 ## Why
 
-Unmaintained dependencies are a perennial top-5 pain in React Native surveys, and the cost keeps climbing now that the New Architecture is the default: a package that looked fine when it was added quietly stops getting releases, never gains New Architecture support, or gets deprecated on npm — and you find out during an upgrade, months after the PR that introduced it merged.
+Unmaintained dependencies are a perennial top-5 pain in React Native surveys, and the cost keeps climbing now that the New Architecture is the default: a package that looked fine when it was added quietly stops getting releases, never gains New Architecture support, or gets deprecated on npm — and you find out during an upgrade, months after the PR that introduced it merged.
 
-Lookup tools exist (the React Native Directory tells you a package's status if you go ask). What's been missing is **enforcement**: the check that runs on every PR, fails when someone adds a dying dependency, and points at the exact line — so the conversation happens at review time, when swapping the package costs five minutes instead of a quarter.
+Lookup tools exist (the React Native Directory tells you a package's status if you go ask). What's been missing is **enforcement**: the check that runs on every PR, fails when someone adds a dying dependency, and points at the exact line — so the conversation happens at review time, when swapping the package costs five minutes instead of a quarter.
 
 `rn-doctor` is that check. Pure TypeScript, zero native code, one command.
 
@@ -40,7 +40,7 @@ jobs:
         with:
           fetch-depth: 0 # required for changed-only (merge-base diff)
 
-      - uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.1
+      - uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.2
         with:
           changed-only: "true"
           base: origin/${{ github.base_ref }}
@@ -61,9 +61,9 @@ npx --yes --package react-native-doctor-ci rn-doctor
 ## GitHub Action reference
 
 ```yaml
-- uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.1
+- uses: AmrithVengalath/react-native-doctor-ci/action@v0.1.2
   with:
-    version: "0.1.0"          # npm version/dist-tag to run (default: latest)
+    version: "0.1.2"          # npm version/dist-tag to run (default: latest)
     policy: ".rn-doctor.yml"  # policy file path (default: auto-detect)
     changed-only: "true"      # only deps added/changed vs base (default: "false")
     base: origin/main         # base ref for changed-only (default: origin/main)
@@ -76,8 +76,8 @@ npx --yes --package react-native-doctor-ci rn-doctor
 
 Notes:
 
-- `changed-only` requires `actions/checkout` with `fetch-depth: 0` — the diff is computed against the merge-base of the PR branch and `base`, same as GitHub's three-dot compare. Without history the run fails with an actionable message telling you exactly that.
-- The default `token` (the workflow's own `GITHUB_TOKEN`) is enough; it's only used to read public repo metadata (archived state, last push). Without any token those fields degrade to `unknown` with a warning — the run never fails because of rate limits.
+- `changed-only` requires `actions/checkout` with `fetch-depth: 0` — the diff is computed against the merge-base of the PR branch and `base`, same as GitHub's three-dot compare. Without history the run fails with an actionable message telling you exactly that.
+- The default `token` (the workflow's own `GITHUB_TOKEN`) is enough; it's only used to read public repo metadata (archived state, last push). Without any token those fields degrade to `unknown` with a warning — the run never fails because of rate limits.
 - Pin `version` for reproducible CI; `latest` is convenient but floats.
 
 ## CLI reference
@@ -98,7 +98,7 @@ rn-doctor [options]
   -h, --help         Show help
 ```
 
-**Exit codes** (stable contract — CI depends on it):
+**Exit codes** (stable contract — CI depends on it):
 
 | Code | Meaning |
 | ---- | ------- |
@@ -108,7 +108,7 @@ rn-doctor [options]
 
 **Environment**: `GITHUB_TOKEN` (optional, enables GitHub repo enrichment), `NO_COLOR` (disables ANSI color), `GITHUB_ACTIONS=true` (auto-enables annotations).
 
-Only `dependencies` are checked — `devDependencies` never ship in your app.
+Only `dependencies` are checked — `devDependencies` never ship in your app.
 
 ## Policy: `.rn-doctor.yml`
 
@@ -132,9 +132,9 @@ allow: []                       # see "Unblocking a PR" below
 
 Each rule takes `error | warn | off` (except `lastPublish`, which takes thresholds or `"off"`).
 
-**How the data is gathered.** Each dependency is enriched in parallel from the npm registry (publish time, deprecation, `codegenConfig`), the [React Native Directory](https://reactnative.directory) (New Architecture support, unmaintained flag, GitHub URL), and the GitHub API (archived, last push — token optional). Results are cached in `.rn-doctor-cache.json` for 24 hours (add it to `.gitignore`; `--no-cache` bypasses).
+**How the data is gathered.** Each dependency is enriched in parallel from the npm registry (publish time, deprecation, `codegenConfig`), the [React Native Directory](https://reactnative.directory) (New Architecture support, unmaintained flag, GitHub URL), and the GitHub API (archived, last push — token optional). Results are cached in `.rn-doctor-cache.json` for 24 hours (add it to `.gitignore`; `--no-cache` bypasses).
 
-**New Architecture verdicts** are tiered honestly: directory says supported → pass; directory says unsupported → `newArchitecture` fires; unknown but the package ships `codegenConfig` → pass with an informational note; unknown otherwise → `newArchUnknown` fires (a warning by default — missing data is not the same as a dead package).
+**New Architecture verdicts** are tiered honestly: directory says supported → pass; directory says unsupported → `newArchitecture` fires; unknown but the package ships `codegenConfig` → pass with an informational note; unknown otherwise → `newArchUnknown` fires (a warning by default — missing data is not the same as a dead package).
 
 **Scope.** `rn-native-only` (default) checks packages that actually couple to React Native: listed in the RN Directory, peer-depend on `react-native`, or ship `android`/`ios` directories. `all-deps` checks everything under `dependencies`.
 
@@ -149,14 +149,14 @@ allow:
     expires: 2027-01-31
 ```
 
-- Suppressed findings still appear in output (marked as allowed) — nothing disappears silently.
+- Suppressed findings still appear in output (marked as allowed) — nothing disappears silently.
 - `expires` is optional but recommended: past that date the allow stops suppressing and findings **escalate to errors**, so exceptions can't quietly outlive their justification.
 - Every finding's message suggests the exact allowlist entry to add, so unblocking is copy-paste.
 
 ## Output formats
 
-- **Pretty** (default): one block per finding — severity badge, message, allow-reason if suppressed, and an evidence link (npm/directory/GitHub) so you can verify every claim.
-- **`--json`**: stable-ordered, timestamp-free (`version: 1`) — safe to snapshot or post-process.
+- **Pretty** (default): one block per finding — severity badge, message, allow-reason if suppressed, and an evidence link (npm/directory/GitHub) so you can verify every claim.
+- **`--json`**: stable-ordered, timestamp-free (`version: 1`) — safe to snapshot or post-process.
 - **`--sarif`**: SARIF 2.1.0, validates against the official schema. Upload to GitHub code scanning:
 
   ```yaml
@@ -167,30 +167,30 @@ allow:
       sarif_file: rn-doctor.sarif
   ```
 
-- **GitHub annotations**: emitted automatically inside GitHub Actions, resolved to the dependency's real line in `package.json` (string-escape-aware — a same-named key under `scripts` can't false-match).
+- **GitHub annotations**: emitted automatically inside GitHub Actions, resolved to the dependency's real line in `package.json` (string-escape-aware — a same-named key under `scripts` can't false-match).
 
 ## Changed-only and monorepos
 
-`--changed-only` is the flagship PR mode: it diffs `dependencies` against the merge-base with `--base` and checks only additions and spec changes (downgrades and protocol changes count too — they're re-checked). Fast, and zero noise from pre-existing debt: adopting rn-doctor on a 5-year-old app doesn't mean fixing 30 findings before the check goes green.
+`--changed-only` is the flagship PR mode: it diffs `dependencies` against the merge-base with `--base` and checks only additions and spec changes (downgrades and protocol changes count too — they're re-checked). Fast, and zero noise from pre-existing debt: adopting rn-doctor on a 5-year-old app doesn't mean fixing 30 findings before the check goes green.
 
 `--workspaces` walks npm/yarn `workspaces` globs or `pnpm-workspace.yaml` and checks every workspace manifest, with findings grouped per manifest and annotations pointing at the right file. Composes with `--changed-only`.
 
 ## FAQ
 
-**Does it check devDependencies?** No — they don't ship in your app. Scope decisions live in the policy file, not flags.
+**Does it check devDependencies?** No — they don't ship in your app. Scope decisions live in the policy file, not flags.
 
 **Is it a security scanner?** No. CVE auditing is `npm audit` / OSV territory. rn-doctor answers a different question: *is this dependency alive and does it have a future on the New Architecture?*
 
-**Does it fix anything?** No — it tells you what's wrong and what to do (allowlist entry, `npx expo install --fix`, Renovate), then gets out of the way.
+**Does it fix anything?** No — it tells you what's wrong and what to do (allowlist entry, `npx expo install --fix`, Renovate), then gets out of the way.
 
-**What if the RN Directory is wrong about a package?** Every finding carries an evidence link so you can check, and a false positive costs one allowlist line. File a correction with the directory — everyone benefits.
+**What if the RN Directory is wrong about a package?** Every finding carries an evidence link so you can check, and a false positive costs one allowlist line. File a correction with the directory — everyone benefits.
 
-**Why is `yaml` the only runtime dependency?** The policy file and `pnpm-workspace.yaml` are YAML, and a spec-compliant YAML parser is not a weekend project — this one is worth its weight. Everything else (HTTP, caching, git diffing, glob matching, SARIF, annotations) is hand-rolled on Node built-ins; less supply chain in a tool whose whole job is judging dependencies.
+**Why is `yaml` the only runtime dependency?** The policy file and `pnpm-workspace.yaml` are YAML, and a spec-compliant YAML parser is not a weekend project — this one is worth its weight. Everything else (HTTP, caching, git diffing, glob matching, SARIF, annotations) is hand-rolled on Node built-ins; less supply chain in a tool whose whole job is judging dependencies.
 
 ## Contributing
 
-Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). The project follows a phased roadmap; out-of-scope items (security auditing, auto-fixing, a hosted service) are listed there.
+Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). The project follows a phased roadmap; out-of-scope items (security auditing, auto-fixing, a hosted service) are listed there.
 
 ## License
 
-[MIT](LICENSE) © Amrith Vengalath
+[MIT](LICENSE) © Amrith Vengalath

package/dist/cli.cjs

@@ -120,7 +120,7 @@ async function mapWithConcurrency(items, fn, concurrency = 8) {
 // package.json
 var package_default = {
   name: "react-native-doctor-ci",
-  version: "0.1.1",
+  version: "0.1.2",
   description: "Policy-as-code CI gate for React Native dependency health: fail PRs that add abandoned, non-New-Architecture, or npm-deprecated dependencies.",
   keywords: [
     "react-native",