vigiles 39.0.0 → 39.1.0

package/action.yml

@@ -36,6 +36,16 @@ inputs:
     description: "Only check that linter rules exist; skip config-enabled checks (maps to the CLI's --catalog-only). 'true' or 'false'."
     required: false
     default: "false"
+  preset:
+    description: >
+      Add a preset for this run, on top of the repo's .vigilesrc.json (maps to
+      the CLI's --preset=; lint only). The names are the ones `extends` takes,
+      with or without the `vigiles:` prefix: 'experimental' turns on the checks
+      not yet measured reliable enough to grade on, at warn — so they report
+      and never fail the run. Comma-separate several. Empty (the default) adds
+      none.
+    required: false
+    default: ""
   working-directory:
     description: "Directory to run vigiles in."
     required: false
@@ -80,6 +90,7 @@ runs:
         VIGILES_VERSION: ${{ inputs.version }}
         VIGILES_MAX_RULES: ${{ inputs.max-rules }}
         VIGILES_CATALOG_ONLY: ${{ inputs.catalog-only }}
+        VIGILES_PRESET: ${{ inputs.preset }}
         VIGILES_ACTION_PATH: ${{ github.action_path }}
         VIGILES_COMMENT: ${{ inputs.comment }}
         VIGILES_CAPABILITY_DIFF: ${{ inputs.capability-diff }}
@@ -114,6 +125,13 @@ runs:
           args+=("--catalog-only")
         fi
 
+        # The CLI validates the name (an unknown preset exits 2 naming the
+        # valid ones), so the value is passed through as written.
+        preset="${VIGILES_PRESET:-}"
+        if [[ -n "${preset// /}" ]]; then
+          args+=("--preset=${preset// /}")
+        fi
+
         # Resolve the runner. 'local' runs the action's own build (CI
         # dogfood via `uses: ./`); an explicit version runs the published npm
         # package at that version. EMPTY (the default) runs the vigiles this

package/dist/audit-report.d.ts

@@ -22,6 +22,7 @@ import type { RuleInventoryItem } from "./rule-inventory.js";
 import type { RuleRouting } from "./rule-routing.js";
 import type { EvidenceCounts } from "./coverage-evidence.js";
 import type { DeprecatedKeyFilesFinding } from "./deprecated-key-files.js";
+import { type FilteredScan, type UngradedGroup } from "./core/apply-rules.js";
 /**
  * The current schema version. Bump only on a BREAKING change to the shape.
  * v2 (2026-07-15): the rule-map `mechanism` enum value for an unrouted rule
@@ -139,6 +140,16 @@ export interface AuditReport {
      * uses the field. Additive/optional — schema version unchanged.
      */
     readonly deprecatedKeyFiles?: readonly DeprecatedKeyFilesFinding[];
+    /**
+     * The UNGRADED rule groups — checks vigiles ships but has not measured as
+     * reliable enough to grade you on. One block per group with a rule this run
+     * turned on (a preset, `--preset=`, or the rule in `rules`), headed by the
+     * group's own label, each rule listed even when it found nothing; absent
+     * when none is on. NEVER scored: `score`, `verdict` and `recommendations`
+     * are computed from the graded view, without these. Additive/optional —
+     * schema version unchanged.
+     */
+    readonly ungraded?: readonly UngradedGroup[];
     /**
      * The adoption preview — "what would vigiles catch in your repo?" Present only
      * when the model-gated tier ran (behind consent); a deterministic read omits it.
@@ -208,7 +219,9 @@ export interface BuildAuditReportOptions extends AuditScoreOptions {
  * The CLI attaches `meta.generatedAt` when it writes the JSON artifact; the
  * HTML-embedded form omits it so the rendered file stays deterministic.
  */
-export declare function buildAuditReport(report: ScanReport, opts: BuildAuditReportOptions): AuditReport;
+export declare function buildAuditReport(
+/** Minted by `applyRules`: an off rule's findings are already gone. */
+report: FilteredScan<ScanReport>, opts: BuildAuditReportOptions): AuditReport;
 /**
  * The versioned envelope for a `audit --json` run over MULTIPLE plugins (a
  * marketplace expanded into its members, or several dirs) — the leaderboard.

package/dist/audit-report.js

@@ -20,6 +20,7 @@ exports.buildMarketplaceReport = buildMarketplaceReport;
 const audit_score_js_1 = require("./audit-score.js");
 const optimize_js_1 = require("./optimize.js");
 const audit_verdict_js_1 = require("./audit-verdict.js");
+const apply_rules_js_1 = require("./core/apply-rules.js");
 /**
  * The current schema version. Bump only on a BREAKING change to the shape.
  * v2 (2026-07-15): the rule-map `mechanism` enum value for an unrouted rule
@@ -74,9 +75,13 @@ function inventoryOf(report) {
 function outputStylesField(n) {
     return n === undefined || n === 0 ? {} : { outputStyles: n };
 }
-/** The scan's concrete finding lists, each present only when non-empty. */
+/**
+ * The scan's concrete finding lists, each present only when non-empty — and the
+ * ungraded groups' blocks, present only when some rule of one is on.
+ */
 function scanFindingLists(report) {
     return {
+        ...(report.ungraded.length > 0 ? { ungraded: report.ungraded } : {}),
         ...(report.danglingRefs.length
             ? { brokenReferences: report.danglingRefs }
             : {}),
@@ -85,16 +90,27 @@ function scanFindingLists(report) {
             : {}),
     };
 }
+/**
+ * The graded half of the report — score, verdict, fixes — read off the GRADED
+ * view (`gradedView`), so an ungraded group's findings can never move it.
+ */
+function gradedPart(report, opts) {
+    const graded = (0, apply_rules_js_1.gradedView)(report);
+    const score = (0, audit_score_js_1.auditScore)(graded, { firingMeasured: opts.firingMeasured });
+    const recommendations = (0, optimize_js_1.optimize)(graded).recommendations;
+    const verdict = (0, audit_verdict_js_1.computeVerdict)({ report: graded, score, recommendations });
+    return { score, verdict, recommendations };
+}
 /**
  * Assemble the versioned {@link AuditReport} from a scan report — pure, no clock.
  * The CLI attaches `meta.generatedAt` when it writes the JSON artifact; the
  * HTML-embedded form omits it so the rendered file stays deterministic.
  */
-function buildAuditReport(report, opts) {
+function buildAuditReport(
+/** Minted by `applyRules`: an off rule's findings are already gone. */
+report, opts) {
     const adoptable = buildAdoptable(opts.adoptableSurfaces);
-    const score = (0, audit_score_js_1.auditScore)(report, { firingMeasured: opts.firingMeasured });
-    const recommendations = (0, optimize_js_1.optimize)(report).recommendations;
-    const verdict = (0, audit_verdict_js_1.computeVerdict)({ report, score, recommendations });
+    const { score, verdict, recommendations } = gradedPart(report, opts);
     return {
         meta: {
             schemaVersion: exports.AUDIT_SCHEMA_VERSION,