rvlib-shipkit 0.35.0 → 0.35.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.35.1
+
+- **SK013's green line claimed a replacement that could not be named.** With the guard declared but not yet installed, the rule WARNed correctly and then printed `closes 14/14 raw runner(s), with the replacement named` directly underneath it. Both lines were about the same file and only one of them was true. The summary now reports what the file actually delivers: the guard is `declared, not yet runnable` until its script resolves.
+
 ## 0.35.0
 
 - **`shipkit pb collection` mints imports of a package that exists.** The pocketbase data layer and the Mantine shell are one package now, `rvlib-pb`: the generated `columns.tsx`, `grid.tsx` and `index.ts` import `Column`, `LiveGrid` and `defineCollectionUI` from `rvlib-pb/ui`, and `LiveList` from `rvlib-pb`. The two tiers are different subpaths on purpose, so a generated grid that took its type from the ui subpath would typecheck and would put `@mantine/core` in the tsconfig of anything that reads it. This generator ships inside the tarball and writes into repos it never sees, so a stale specifier here keeps producing broken scaffolds long after a rename lands: the suite now asserts every import string the generator emits, which nothing did before.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "0.35.0",
+    "version": "0.35.1",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",
     "type": "module",

package/src/core/discover-checks.ts

@@ -32,6 +32,12 @@ export type DiscoveredCheck = {
     /** `export const never = 'why'`, read statically — a DECIDED never
      *  cacheable, which takes the check off the burn-down list. */
     never: string | null
+    /** `export const gate = false`, read statically — this check is NOT part of
+     *  `shipkit ci`. `ci` answers "is my change good"; a check that answers
+     *  something else, and that can sit red for months without anything being
+     *  wrong, does not belong in the answer. `shipkit check` still runs it.
+     *  Default true: a check is in the gate unless it opts out by name. */
+    gate: boolean
 }
 
 // read without importing: checks run as subprocesses, and discovery must stay
@@ -44,6 +50,10 @@ const BLOCKING_RE = /^\s*export\s+const\s+blocking\s*(?::\s*boolean\s*)?=\s*(tru
 const INPUTS_RE = /^\s*export\s+const\s+inputs\s*(?::[^=]*)?=\s*\[([^\]]*)\]/m
 const TTL_RE = /^\s*export\s+const\s+ttl\s*(?::\s*string\s*)?=\s*['"]([^'"]+)['"]/m
 const NEVER_RE = /^\s*export\s+const\s+never\s*(?::\s*string\s*)?=\s*['"]([^'"]+)['"]/m
+// `export const gate = false` takes a check out of `shipkit ci`. Only the
+// literal false opts out: anything unreadable stays in the gate, because a
+// scanner that guesses its way to SKIPPING a check is how coverage disappears
+const GATE_RE = /^\s*export\s+const\s+gate\s*(?::\s*boolean\s*)?=\s*false\s*$/m
 const STRING_ITEM_RE = /['"]([^'"]+)['"]/g
 
 export function discoverChecks(root: string): DiscoveredCheck[] {
@@ -69,6 +79,7 @@ export function discoverChecks(root: string): DiscoveredCheck[] {
         let inputs: string[] | null = null
         let ttl: string | null = null
         let never: string | null = null
+        let gate = true
         try {
             const src = readFileSync(f, 'utf8')
             const m = src.match(BLOCKING_RE)
@@ -80,7 +91,8 @@ export function discoverChecks(root: string): DiscoveredCheck[] {
             }
             ttl = src.match(TTL_RE)?.[1] ?? null
             never = src.match(NEVER_RE)?.[1] ?? null
+            gate = src.match(GATE_RE) == null
         } catch {}
-        return { path: f, name, blocking, inputs, ttl, never }
+        return { path: f, name, blocking, inputs, ttl, never, gate }
     })
 }

package/src/core/run-check.ts

@@ -50,6 +50,11 @@ export type CheckOpts = {
      *  spends a third-party API call per publish. Undeclared checks are still
      *  collected, because an unclassified check stays fatal. */
     onlyBlocking?: boolean
+    /** the caller is the GATE (`shipkit ci`), so checks that declared
+     *  `export const gate = false` are skipped. `shipkit check` leaves it unset
+     *  and runs everything: the health surface is where a human todo list
+     *  belongs, and the gate is not. */
+    gateOnly?: boolean
     /** the caller narrowed the run to these ids (`ci --only`). Empty or absent
      *  means everything. A `--only` that narrowed TASKS while every check still
      *  ran made the flag actively harmful: `ci --only cycles`, a 0.03s task,
@@ -201,6 +206,12 @@ export async function collectChecks(root: string, o: CheckOpts = {}): Promise<Ch
         // file wins, then the repo default, then nothing: an unclassified
         // check is an error, never a guess
         if (!matchesOnly(o.only, d.name, rel)) continue
+        // `ci` answers "is my change good". A check that answers something else,
+        // and that can sit red for months with nothing wrong, is not part of
+        // that answer at any interval. `shipkit check` still runs it, and
+        // naming it in `--only` still runs it, so opting out is never a way to
+        // make a check unreachable.
+        if (o.gateOnly === true && !d.gate && o.only == null) continue
         const blocking = d.blocking ?? c.checkDefaults?.blocking
         if (blocking == null) undeclared.push(rel)
         if (o.onlyBlocking === true && blocking !== true) continue

package/src/core/run-ci.ts

@@ -271,7 +271,7 @@ async function runCiInScope(root: string, o: CiOpts = {}): Promise<number> {
     if (survey != null) await survey
     const checks = o.skipChecks === true
         ? { lines: [], blocked: false, advisoryFailures: [], undeclared: [] }
-        : await collectChecks(root, { status: false, config: c, frozen: o.frozen, onlyBlocking: o.onlyBlockingChecks, only: o.onlyIds, fresh: o.fresh, ledger, reportHome: false })
+        : await collectChecks(root, { status: false, config: c, frozen: o.frozen, onlyBlocking: o.onlyBlockingChecks, only: o.onlyIds, fresh: o.fresh, ledger, reportHome: false, gateOnly: true })
     if (priorShare == null) delete process.env[SHARE_ENV]; else process.env[SHARE_ENV] = priorShare
     for (const f of [sharePath, `${sharePath}.lock`]) { try { rmSync(f, { force: true }) } catch {} }
     const color = process.stdout.isTTY && process.env.NO_COLOR == null

package/src/rules/SK013-one-way-in-policy.ts

@@ -103,10 +103,12 @@ export const oneWayInPolicy: Rule = {
         if (missing.length > 0)
             t.fail(`${SETTINGS_PATH}: ${missing.length} raw runner(s) still permitted (${missing.slice(0, 3).join(', ')}${missing.length > 3 ? ', …' : ''}) — those calls never reach shipkit, so nothing is cached and no run can be attached to`)
         const guard = guardHookCommand(s)
+        let guardRuns = false
         if (guard == null)
             t.fail(`${SETTINGS_PATH}: no PreToolUse guard — a bare deny tells the model only that it was denied, so it goes looking for another runner instead of the shipkit command`)
         else {
             const missing = guardScriptMissing(env.root, guard)
+            guardRuns = missing == null
             // the hook is DECLARED either way, so it starts working the moment
             // the dependency lands: no second fix run, nothing to remember. An
             // uninstalled dependency is therefore a WARN naming the command
@@ -124,7 +126,11 @@ export const oneWayInPolicy: Rule = {
                     `point it at this repo's own copy of hooks/one-way-in-guard.ts, or delete the hook and let the deny list stand alone`,
                 )
         }
-        if (!t.failed) t.ok(`${SETTINGS_PATH} closes ${want.length}/${RAW_RUNNERS.length} raw runner(s), with the replacement named`)
+        // the summary states only what the file actually delivers: claiming the
+        // replacement is named while the guard cannot run is the green that
+        // measured nothing, one line under the WARN that says otherwise
+        if (!t.failed)
+            t.ok(`${SETTINGS_PATH} closes ${want.length}/${RAW_RUNNERS.length} raw runner(s)${guardRuns ? ', with the replacement named' : ' — the guard that names the replacement is declared, not yet runnable'}`)
     },
     // MERGES, never rewrites: this file also carries the attribution silencer,
     // a repo's own allow list and its own hooks, and clobbering those to fix a