vouchington-tooling 0.13.2 → 0.13.4

package/dist/scc-complexity/index.mjs

@@ -4,11 +4,14 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { baselineEntryByScopeAndFile, normalizeSccComplexityBaseline, validateSccComplexityBaseline, } from './baseline.mjs';
-import { canonicalRepoPath, isInsideRepo } from './paths.mjs';
+import { SCC_COMPLEXITY_LIMIT } from './constants.mjs';
+import { canonicalRepoPath } from './paths.mjs';
 import { parseSccComplexityValues } from './parser.mjs';
+import { normalizeScopes, scopesFor } from './scope-config.mjs';
+import { escapeWorkflowCommandMessage, escapeWorkflowCommandProperty } from './workflow-command.mjs';
 const execFileAsync = promisify(execFile);
 export { parseSccComplexityBaseline, SCC_COMPLEXITY_BASELINE_VERSION } from './baseline.mjs';
-export const SCC_COMPLEXITY_LIMIT = 50;
+export { SCC_COMPLEXITY_LIMIT } from './constants.mjs';
 const DEFAULT_INCLUDE_EXT = 'js,mts,jsx,ts,tsx';
 const DEFAULT_EXCLUDE_DIR = '.git,fixtures,__tests__,test-helpers';
 const DEFAULT_NOT_MATCH = String.raw `\.(test|spec)\.`;
@@ -31,10 +34,14 @@ export function buildSccArgs(options = {}) {
 }
 export async function checkSccComplexity(ctx, options = {}, runScc) {
     if (!ctx.isInsideGitRepo)
-        return { errors: [`::error::${ctx.repoRoot} is not inside a git repository`] };
+        return {
+            errors: [
+                `::error::${escapeWorkflowCommandMessage(ctx.repoRoot)} is not inside a git repository`,
+            ],
+        };
     const dir = await mkdtemp(join(tmpdir(), options.tmpdirPrefix ?? DEFAULT_TMPDIR_PREFIX));
     try {
-        const scopes = normalizeScopes(scopesFor(options), ctx.repoRoot);
+        const scopes = await normalizeScopes(scopesFor(options), ctx.repoRoot, options.limit);
         const trackedFileSet = new Set([...ctx.trackedFileSet].map((file) => canonicalRepoPath(ctx.repoRoot, file)));
         const baseline = options.baseline && normalizeSccComplexityBaseline(options.baseline, ctx.repoRoot);
         const results = await runScopes(ctx, options, scopes, dir, trackedFileSet, runScc);
@@ -44,7 +51,7 @@ export async function checkSccComplexity(ctx, options = {}, runScc) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        return { errors: [`::error::scc-complexity failed: ${message}`] };
+        return { errors: [`::error::scc-complexity failed: ${escapeWorkflowCommandMessage(message)}`] };
     }
     finally {
         await rm(dir, { force: true, recursive: true });
@@ -55,41 +62,16 @@ export function parseSccComplexityViolations(json, trackedFileSet, limit = SCC_C
         .filter((value) => value.complexity > limit)
         .toSorted(compare);
 }
-function scopesFor(options) {
-    if (!options.scopes) {
-        if (options.baseline)
-            throw new Error('baseline requires named scopes');
-        return [{ includePaths: [], name: '', ...options }];
-    }
-    if (options.scopes.length === 0)
-        throw new Error('scopes must not be empty');
-    const names = new Set();
-    for (const scope of options.scopes) {
-        if (!scope.name || names.has(scope.name))
-            throw new Error(`scope name ${scope.name || '(empty)'} is invalid`);
-        if (scope.includePaths.length === 0 || scope.includePaths.some((path) => !path))
-            throw new Error(`scope ${scope.name} must include at least one path`);
-        names.add(scope.name);
-    }
-    return options.scopes;
-}
-function normalizeScopes(scopes, repoRoot) {
-    return scopes.map((scope) => {
-        const includePaths = scope.includePaths.map((path) => canonicalRepoPath(repoRoot, path));
-        if (includePaths.some((path) => !isInsideRepo(path)))
-            throw new Error(`scope ${scope.name} includes a path outside the repository`);
-        return { ...scope, includePaths };
-    });
-}
 async function runScopes(ctx, options, scopes, dir, trackedFileSet, runScc) {
     const results = [];
     for (const [index, scope] of scopes.entries()) {
         const outputPath = join(dir, `scope-${index}.json`);
         const resolve = runScc ?? ((path) => runSccJson(ctx.repoRoot, path, options, scope));
-        results.push({
-            scope,
-            values: parseSccComplexityValues(await resolve(outputPath, scope), trackedFileSet, ctx.repoRoot),
-        });
+        const values = parseSccComplexityValues(await resolve(outputPath, scope), trackedFileSet, ctx.repoRoot);
+        const outside = values.find((value) => !isInScopeResult(scope, value.file));
+        if (outside)
+            throw new Error(`scope ${scope.name} received result outside its paths: ${outside.file}`);
+        results.push({ scope, values });
     }
     return results;
 }
@@ -106,9 +88,15 @@ function formatViolations(results, baseline) {
         const detail = entry
             ? `scc complexity ${value.complexity} exceeds baseline ceiling ${entry.complexity}`
             : `scc complexity ${value.complexity} exceeds ${limit}; simplify or split this file`;
-        return [`::error file=${value.file}::${prefix}${value.file}: ${detail}`];
+        return [
+            `::error file=${escapeWorkflowCommandProperty(value.file)}::${escapeWorkflowCommandMessage(`${prefix}${value.file}: ${detail}`)}`,
+        ];
     }));
 }
+function isInScopeResult(scope, file) {
+    return (scope.includePaths.length === 0 ||
+        scope.includePaths.some((path) => file === path || file.startsWith(`${path}/`) || path === '.'));
+}
 async function runSccJson(repoRoot, outputPath, options, scope) {
     try {
         await execFileAsync(options.command ?? 'scc', [...buildSccArgs({ ...options, ...scope }), ...scope.includePaths, '--output', outputPath], { cwd: repoRoot, maxBuffer: 1024 * 1024 });

package/dist/scc-complexity/paths.d.mts

@@ -1,3 +1,4 @@
 export declare function canonicalRepoPath(repoRoot: string, path: string): string;
-export declare function isInsideRepo(path: string): boolean;
 export declare function isInScope(file: string, includePaths: readonly string[]): boolean;
+export declare function canonicalScopePath(repoRoot: string, path: string): Promise<string>;
+export declare function assertWorkflowCommandData(value: string, label: string): void;

package/dist/scc-complexity/paths.mjs

@@ -1,11 +1,44 @@
-import { relative, resolve } from 'node:path';
+import { lstat, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, win32 } from 'node:path';
 export function canonicalRepoPath(repoRoot, path) {
     const relativePath = relative(repoRoot, resolve(repoRoot, path.replaceAll('\\', '/'))).replaceAll('\\', '/');
     return relativePath || '.';
 }
-export function isInsideRepo(path) {
+function isInsideRepo(path) {
     return path !== '..' && !path.startsWith('../');
 }
 export function isInScope(file, includePaths) {
     return includePaths.some((includePath) => includePath === '.' || file === includePath || file.startsWith(`${includePath}/`));
 }
+export async function canonicalScopePath(repoRoot, path) {
+    if (isAbsolute(path) || win32.parse(path).root)
+        throw new Error('path is outside the repository');
+    const physicalRoot = await realpath(repoRoot);
+    const candidatePath = resolve(repoRoot, path.replaceAll('\\', '/'));
+    if (!isInsideRepo(canonicalRepoPath(repoRoot, candidatePath)))
+        throw new Error('path is outside the repository');
+    const physicalPath = await physicalPathFor(candidatePath, repoRoot, physicalRoot);
+    const canonicalPath = canonicalRepoPath(physicalRoot, physicalPath);
+    if (!isInsideRepo(canonicalPath))
+        throw new Error('path is outside the repository');
+    return canonicalPath;
+}
+export function assertWorkflowCommandData(value, label) {
+    if (/[\r\n]/.test(value))
+        throw new Error(`${label} contains a workflow command control character`);
+}
+async function physicalPathFor(path, repoRoot, physicalRoot) {
+    let existingPath = path;
+    while (existingPath !== repoRoot) {
+        try {
+            const physicalPath = await realpath(existingPath);
+            return resolve(physicalPath, relative(existingPath, path));
+        }
+        catch (error) {
+            if ((await lstat(existingPath).catch(() => undefined))?.isSymbolicLink())
+                throw error;
+            existingPath = dirname(existingPath);
+        }
+    }
+    return resolve(physicalRoot, relative(repoRoot, path));
+}

package/dist/scc-complexity/scope-config.d.mts

@@ -0,0 +1,3 @@
+import type { SccComplexityOptions, SccComplexityScope } from './types.mts';
+export declare function scopesFor(options: SccComplexityOptions): readonly SccComplexityScope[];
+export declare function normalizeScopes(scopes: readonly SccComplexityScope[], repoRoot: string, topLevelLimit: number | undefined): Promise<readonly SccComplexityScope[]>;

package/dist/scc-complexity/scope-config.mjs

@@ -0,0 +1,35 @@
+import { assertWorkflowCommandData, canonicalScopePath } from './paths.mjs';
+export function scopesFor(options) {
+    if (!options.scopes) {
+        if (options.baseline)
+            throw new Error('baseline requires named scopes');
+        return [{ includePaths: [], name: '', ...options }];
+    }
+    if (options.scopes.length === 0)
+        throw new Error('scopes must not be empty');
+    const names = new Set();
+    for (const scope of options.scopes) {
+        if (!scope.name || names.has(scope.name))
+            throw new Error(`scope name ${scope.name || '(empty)'} is invalid`);
+        assertWorkflowCommandData(scope.name, 'scope name');
+        if (scope.includePaths.length === 0 || scope.includePaths.some((path) => !path))
+            throw new Error(`scope ${scope.name} must include at least one path`);
+        for (const path of scope.includePaths)
+            assertWorkflowCommandData(path, `scope ${scope.name} path`);
+        names.add(scope.name);
+    }
+    return options.scopes;
+}
+export async function normalizeScopes(scopes, repoRoot, topLevelLimit) {
+    return Promise.all(scopes.map(async (scope) => {
+        let includePaths;
+        try {
+            includePaths = await Promise.all(scope.includePaths.map((path) => canonicalScopePath(repoRoot, path)));
+        }
+        catch {
+            throw new Error(`scope ${scope.name} includes a path outside the repository`);
+        }
+        const limit = scope.limit ?? topLevelLimit;
+        return limit === undefined ? { ...scope, includePaths } : { ...scope, includePaths, limit };
+    }));
+}

package/dist/scc-complexity/workflow-command.d.mts

@@ -0,0 +1,2 @@
+export declare function escapeWorkflowCommandMessage(value: string): string;
+export declare function escapeWorkflowCommandProperty(value: string): string;

package/dist/scc-complexity/workflow-command.mjs

@@ -0,0 +1,6 @@
+export function escapeWorkflowCommandMessage(value) {
+    return value.replaceAll('%', '%25').replaceAll('\r', '%0D').replaceAll('\n', '%0A');
+}
+export function escapeWorkflowCommandProperty(value) {
+    return escapeWorkflowCommandMessage(value).replaceAll(':', '%3A').replaceAll(',', '%2C');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -208,6 +208,11 @@
       "import": "./dist/gha-claude-post-review/index.mjs",
       "default": "./dist/gha-claude-post-review/index.mjs"
     },
+    "./gha-check-run": {
+      "types": "./dist/gha-check-run/index.d.mts",
+      "import": "./dist/gha-check-run/index.mjs",
+      "default": "./dist/gha-check-run/index.mjs"
+    },
     "./http-link-pagination": {
       "types": "./dist/http-link-pagination/index.d.mts",
       "import": "./dist/http-link-pagination/index.mjs",