workspace-conformance 1.2.1 → 1.3.0

package/README.md

@@ -10,7 +10,7 @@ It complements the workspace architecture rules of [`@exadev/eslint-config`](htt
 pnpm add -D workspace-conformance @exadev/config cosmiconfig 'typescript@^6'
 ```
 
-`cosmiconfig` (`^9.0.0 || ^10.0.0`) is a peer dependency because `@exadev/config` loads config files through it. `typescript` (`^5.9.0 || ^6.0.0`) is a peer dependency because dependency-cruiser needs it to parse TypeScript and supports versions below 7 (the range is in the install command because an unpinned `typescript` installs a newer major, which pnpm only warns about); the import checks fail with a configuration error when dependency-cruiser cannot load it. ts-morph bundles its own compiler and does not use yours. The package supports the Node lines dependency-cruiser and its own dependencies support: 22.13 and later 22, 24, and 26 and later.
+`cosmiconfig` (`^9.0.0 || ^10.0.0`) is a peer dependency because `@exadev/config` loads config files through it. `typescript` (`^5.9.0 || ^6.0.0`) is a peer dependency because dependency-cruiser needs it to parse TypeScript and supports versions below 7 (the range is in the install command because an unpinned `typescript` installs a newer major, which pnpm only warns about); the import checks fail with a configuration error when dependency-cruiser cannot load it. ts-morph bundles its own compiler and does not use yours. `eslint` (`^9.0.0 || ^10.0.0`) is an optional peer dependency, needed only by the `eslint` check, which uses the copy installed in the repository it checks. The package supports the Node lines dependency-cruiser and its own dependencies support: 22.13 and later 22, 24, and 26 and later.
 
 Configure the checks in `exadev.config.ts`:
 
@@ -161,6 +161,33 @@ False positives and blind spots:
 - Config variants: only the directory searched is looked at, whereas wrangler also finds a config in a parent directory and follows a redirected config; a repository with both `wrangler.json` and `wrangler.toml` is judged by the first, and a `migrations_pattern` that narrows which files are applied is not read. A generator config that computes `out` from the environment is judged by its value in the process running the check.
 - Scripts: a script is matched by the text of the command, so `drizzle-kit migrate` run against a local database for tests is reported, and a command assembled in a shell variable or run from a file the script calls is not seen. Narrow `packageJsons` to exempt a package.
 
+### ESLint
+
+**`eslint`** proves that the repository's own ESLint is applied. Every other lint rule runs inside ESLint, so none of them can notice a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted; the repository then looks configured and enforces nothing. This check asks ESLint itself, through its Node API, and carries no ESLint config of its own: a flat config holds plugin objects, a parser and functions, and editors and CI expect `eslint.config.*` where it already is.
+
+ESLint (`^9.0.0 || ^10.0.0`) is an optional peer dependency, needed only by this check. It is resolved from the directory the checks run in, the way a module there would find it, and not from this package, so the answer is the one the repository's own lint script gets. When `eslint` does not resolve from there the run fails with a configuration error. When ESLint finds no config file for a sample the check reports `eslint/no-config` and does not substitute one.
+
+| Option | Meaning |
+|---|---|
+| `samples` | Required. One file per kind of source the repository lints (`src/index.ts`, `package.json`, `eslint.config.ts`), as a path or `{ path, rules }`. A path need not exist: ESLint resolves a file's configuration from its path alone. |
+| `rules` | Rules required for every sample, each with the severity it must have at least: `warn` is met by `warn` or `error`, `error` only by `error`. Rule entries in the form `[severity, ...options]` and numeric severities are read as their severity. A sample's own `rules` are added to these and win. |
+| `configFile` | A config file to judge instead of the one ESLint finds from the working directory. |
+| `lint` | Also lint the workspace and report every message it produces. Off when omitted. |
+| `lintPatterns` | What `lint` lints, as file and directory patterns. `.` when omitted. |
+
+The default level lints nothing. For each sample it calls `calculateConfigForFile`, the same call the CLI's `--print-config` makes, which applies `files` and `ignores`. A file that is ignored, or that no configuration block matches, resolves to no configuration (`isPathIgnored` is that call returning nothing), and that is `eslint/not-linted`. Otherwise each required rule must be configured at the required severity: `eslint/rule-missing`, `eslint/rule-off` or `eslint/rule-too-weak`, each naming the rule and the file.
+
+With `lint` the check also lints the workspace through `lintFiles` and maps every message to a violation at its position. The code names the rule, `eslint/lint/<rule id>`, so `eslint/lint/no-console` and `eslint/lint/@scope/plugin/rule` are stable; a parsing error is `eslint/fatal` and a message with no rule, such as an unused disable directive, is `eslint/lint-message`. A pattern that matches no file, or only ignored files, is `eslint/nothing-linted`. Warnings are reported as well as errors, since a repository that fails its lint script on warnings (`--max-warnings 0`) is judged by what that script reports.
+
+Limits:
+
+- An external config is a black box. The check sees which rules are active on a file, not why, so it cannot tell a rule enabled by a shared preset from one written locally. Require the rules that matter and let the repository decide how it gets them.
+- It reads the config ESLint resolves for each sample, and a sample stands for the files like it. A rule can be off for one directory the samples do not cover, so choose a sample for each kind of source and each directory with its own override.
+- An ignored file and a file that no configuration block matches both resolve to nothing and are reported the same way.
+- Only rule severities are compared, not rule options.
+- Flat config only: the ESLint 9 and later `ESLint` class. Legacy `.eslintrc` configuration is not read.
+- A config that is a TypeScript file needs whatever ESLint itself needs to load it (`jiti`), installed where ESLint is.
+
 ### Workflows
 
 The `workflow-*` checks read GitHub Actions workflow files and run offline. Each file under `.github/workflows` is parsed into a model of its events, jobs, the transitive `needs` graph, `if` conditions, effective permissions (a job's own declaration replaces the workflow's, it is not merged with it) and effective environment (workflow, then job, then step), and the checks read that model. A file that is not YAML, or is not shaped like a workflow, fails the run with a configuration error instead of being skipped. Expressions (`${{ ... }}`) are never evaluated: a value that is an expression is treated as unknown, and a check that needs a literal ignores it.
@@ -256,7 +283,7 @@ it('conforms to the workspace layout', async () => {
 });
 ```
 
-Every check is also exported as a function taking `{ cwd, options }` (and `layout` for the import checks): `aggregateMappers`, `commandTypes`, `importUphill`, `importRankSkip`, `importCrossSlice`, `importIsolatedGroups`, `importCycles`, `instructionSymlinks`, `singleStorybook`, `commitTypes`, `dockerfilePackageManager`, `migrationsDirectory`, the workflow checks (`workflowJobOrdering`, `workflowSkippableJobs`, `workflowRunnerResolution`, `workflowVersionSingleSource`, `workflowCredentials`, `workflowRepositoryDispatch`, `workflowUpdateBotCooldown`, `workflowMergeGroup` and `workflowActionPinning`) and, taking `{ cwd, options, github }`, the settings checks (`settingsMergeMethods`, `settingsRequiredChecks` and `settingsReviewThreadResolution`). These take options and a layout as already validated and do not check them again; go through `runChecks` for validation. `parseWorkflow` and `loadWorkflows` expose the workflow model the workflow checks read. A check is a function that returns `Promise<readonly Violation[]>`, where a `Violation` is `{ code, message, file, location? }`.
+Every check is also exported as a function taking `{ cwd, options }` (and `layout` for the import checks): `aggregateMappers`, `commandTypes`, `importUphill`, `importRankSkip`, `importCrossSlice`, `importIsolatedGroups`, `importCycles`, `instructionSymlinks`, `singleStorybook`, `commitTypes`, `dockerfilePackageManager`, `migrationsDirectory`, `eslint`, the workflow checks (`workflowJobOrdering`, `workflowSkippableJobs`, `workflowRunnerResolution`, `workflowVersionSingleSource`, `workflowCredentials`, `workflowRepositoryDispatch`, `workflowUpdateBotCooldown`, `workflowMergeGroup` and `workflowActionPinning`) and, taking `{ cwd, options, github }`, the settings checks (`settingsMergeMethods`, `settingsRequiredChecks` and `settingsReviewThreadResolution`). These take options and a layout as already validated and do not check them again; go through `runChecks` for validation. `parseWorkflow` and `loadWorkflows` expose the workflow model the workflow checks read. A check is a function that returns `Promise<readonly Violation[]>`, where a `Violation` is `{ code, message, file, location? }`.
 
 ### Proving a handler map is exhaustive
 
@@ -303,6 +330,10 @@ CI also runs `pnpm exec publint` and `pnpm exec attw --pack` after the build, an
 
 Each check has a fixture that violates it and one that does not, under `test/fixtures`; the file-tree checks that need git build a repository in a temporary directory, the workflow checks have their fixtures under `test/fixtures/workflows`, and the settings checks run against an in-memory `GitHubClient`. The fixtures are excluded from the project's own typecheck and lint.
 
+### Releases
+
+Every push to `main` runs semantic-release once the commitlint, lint, typecheck and package jobs pass. It derives the next version from the Conventional Commits since the last tag, publishes to npm through trusted publishing with provenance, creates the tag and the GitHub Release, and pushes a `chore(release)` commit that updates `CHANGELOG.md` and `package.json`. `main` is protected by a ruleset that requires the Required Checks status, a branch up to date with `main`, linear history, and forbids deletion and non-fast-forward pushes. Pull requests therefore reach `main` by rebase merge once checks pass, and the release commit and tag are pushed over SSH with the repository deploy key, which the ruleset lets bypass it (as it does organisation admins). The key exists on disk only for the release step.
+
 CI selects its runner with `ExaDev/runner-fallback-action` (self-hosted fleet first, Blacksmith as fallback). The release job stays on a GitHub-hosted runner because npm trusted publishing needs one, and publishes with provenance through OIDC, with no stored token. The repository deploy key (the `RELEASE_DEPLOY_KEY` secret) is a ruleset bypass actor, so it is written to disk by the step immediately before the release step, and only the release step's own environment carries `GIT_SSH_COMMAND` (absolute `/usr/bin/ssh`, no ssh config, a pinned GitHub host key, only the ssh protocol allowed); the key is deleted afterwards. The build and package checks run before the key exists and the release step sets `NPM_CONFIG_IGNORE_SCRIPTS`, so no dev dependency runs beside the key, the job's actions are pinned by commit SHA, and the checkout, the action setup and the dependency install run with no write-capable credential in git config. That limits what code from those steps can read; it is not a sandbox, since a process started earlier in the job still runs as the same user. `release.config.ts` sets an SSH `repositoryUrl`, so semantic-release pushes the release commit and tag over SSH. The default `GITHUB_TOKEN` cannot bypass a branch ruleset on `main`, and semantic-release falls back to pushing as it only when the SSH push fails, so the job dry-run pushes first and fails before publishing if the key does not authenticate, and refuses the https URL outright. Commits follow [Conventional Commits](https://www.conventionalcommits.org); semantic-release derives the version from them.
 
 `README.md`, `AGENTS.md` and `CLAUDE.md` are one file: the two instruction files are tracked symlinks to this one.

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { z } from "zod";
@@ -2498,6 +2499,179 @@ const importUphillSpec = {
 	})
 };
 //#endregion
+//#region src/checks/eslint.ts
+/**
+* The patterns the full level lints when the options name none.
+*/
+const DEFAULT_LINT_PATTERNS = ["."];
+const SEVERITY_RANK = {
+	off: 0,
+	warn: 1,
+	error: 2
+};
+function hasEslintClass(value) {
+	return isRecord(value) && typeof value["ESLint"] === "function";
+}
+/**
+* The `ESLint` class of the ESLint installed where the checks run, found the way a module in `cwd` finds it. It is not this package's own copy, so the results agree with the repository's own lint script.
+*/
+function loadEslint(cwd) {
+	const requireFromCwd = createRequire(join(cwd, "package.json"));
+	try {
+		requireFromCwd.resolve("eslint");
+	} catch (error) {
+		throw new ConformanceError(`the eslint check uses the repository's own ESLint, and 'eslint' does not resolve from ${cwd}; install it there`, { cause: error });
+	}
+	const loaded = requireFromCwd("eslint");
+	if (!hasEslintClass(loaded)) throw new ConformanceError(`the 'eslint' that resolves from ${cwd} does not export the ESLint class of the Node API`);
+	return loaded.ESLint;
+}
+/**
+* The severity a rule entry resolves to. An entry is a severity or an array whose first element is one, and a severity is `0`, `1`, `2`, `'off'`, `'warn'` or `'error'`; `calculateConfigForFile` returns whichever form the config was written in.
+*/
+function normaliseSeverity(entry) {
+	const severity = Array.isArray(entry) ? entry[0] : entry;
+	if (severity === 0 || severity === "off") return "off";
+	if (severity === 1 || severity === "warn") return "warn";
+	if (severity === 2 || severity === "error") return "error";
+	throw new ConformanceError(`ESLint resolved ${JSON.stringify(entry)} as a rule entry, which is not a severity or an array that starts with one`);
+}
+/**
+* The severity of each rule in a resolved configuration.
+*/
+function resolvedSeverities(config) {
+	if (!isRecord(config)) throw new ConformanceError("ESLint resolved a configuration that is not an object");
+	const { rules } = config;
+	if (rules !== void 0 && !isRecord(rules)) throw new ConformanceError("ESLint resolved a configuration whose 'rules' is not an object");
+	return new Map(Object.entries(rules ?? {}).map(([rule, entry]) => [rule, normaliseSeverity(entry)]));
+}
+/**
+* Whether `error` is the one `calculateConfigForFile` throws when ESLint finds no config file for the path.
+*/
+function isMissingConfig(error) {
+	return isRecord(error) && error["messageTemplate"] === "config-file-missing";
+}
+function sampleOf(sample) {
+	return typeof sample === "string" ? { path: sample } : sample;
+}
+function ruleViolations(file, required, actual) {
+	return Object.entries(required).flatMap(([rule, severity]) => {
+		const found = actual.get(rule);
+		if (found === void 0) return [{
+			code: "eslint/rule-missing",
+			message: `the rule '${rule}' is not configured for ${file} (required: ${severity})`,
+			file
+		}];
+		if (found === "off") return [{
+			code: "eslint/rule-off",
+			message: `the rule '${rule}' is off for ${file} (required: ${severity})`,
+			file
+		}];
+		if (SEVERITY_RANK[found] < SEVERITY_RANK[severity]) return [{
+			code: "eslint/rule-too-weak",
+			message: `the rule '${rule}' is '${found}' for ${file} (required: ${severity})`,
+			file
+		}];
+		return [];
+	});
+}
+async function sampleViolations(eslint, sample, shared) {
+	const file = sample.path;
+	let config;
+	try {
+		config = await eslint.calculateConfigForFile(file);
+	} catch (error) {
+		if (isMissingConfig(error)) return [{
+			code: "eslint/no-config",
+			message: `ESLint finds no config file for ${file}; the check does not fall back to a config of its own`,
+			file
+		}];
+		throw new ConformanceError(`ESLint could not resolve its configuration for ${file}`, { cause: error });
+	}
+	if (config === void 0) return [{
+		code: "eslint/not-linted",
+		message: `${file} is not linted: it is ignored, or no configuration block matches it`,
+		file
+	}];
+	return ruleViolations(file, {
+		...shared,
+		...sample.rules
+	}, resolvedSeverities(config));
+}
+/**
+* Whether `error` is ESLint refusing a pattern because it selects no file that is linted.
+*/
+function isNothingLinted(error) {
+	return error instanceof Error && isRecord(error) && (error["messageTemplate"] === "file-not-found" || error["messageTemplate"] === "all-matched-files-ignored");
+}
+function messageViolation(cwd, result, message) {
+	const file = relativePosix(cwd, result.filePath);
+	const location = {
+		line: message.line,
+		column: message.column
+	};
+	if (message.ruleId !== null) {
+		const severity = message.severity === 1 ? "warn" : "error";
+		return {
+			code: `eslint/lint/${message.ruleId}`,
+			message: `${message.ruleId} (${severity}): ${message.message}`,
+			file,
+			location
+		};
+	}
+	return message.fatal === true ? {
+		code: "eslint/fatal",
+		message: message.message,
+		file,
+		location
+	} : {
+		code: "eslint/lint-message",
+		message: message.message,
+		file,
+		location
+	};
+}
+function byPosition(left, right) {
+	return left.file.localeCompare(right.file) || (left.location?.line ?? 0) - (right.location?.line ?? 0) || (left.location?.column ?? 0) - (right.location?.column ?? 0) || left.code.localeCompare(right.code);
+}
+/**
+* Lints the workspace through the Node API, with the repository's own config, and maps every message to a violation. A pattern that selects no linted file is itself a violation, since the workspace is then not linted at all.
+*/
+async function lintViolations(cwd, eslint, patterns) {
+	const violations = [];
+	const results = /* @__PURE__ */ new Map();
+	for (const pattern of patterns) try {
+		for (const result of await eslint.lintFiles([pattern])) results.set(result.filePath, result);
+	} catch (error) {
+		if (!isNothingLinted(error)) throw new ConformanceError(`ESLint could not lint '${pattern}'`, { cause: error });
+		violations.push({
+			code: "eslint/nothing-linted",
+			message: error.message,
+			file: pattern
+		});
+	}
+	for (const result of results.values()) for (const message of result.messages) violations.push(messageViolation(cwd, result, message));
+	return violations.sort(byPosition);
+}
+/**
+* Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+*
+* It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+*
+* The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+*/
+const eslint = async ({ cwd, options }) => {
+	const instance = new (loadEslint(cwd))({
+		cwd,
+		...options.configFile === void 0 ? {} : { overrideConfigFile: resolve(cwd, options.configFile) }
+	});
+	const shared = options.rules ?? {};
+	const violations = [];
+	for (const sample of options.samples.map(sampleOf)) violations.push(...await sampleViolations(instance, sample, shared));
+	if (options.lint === true) violations.push(...await lintViolations(cwd, instance, options.lintPatterns ?? DEFAULT_LINT_PATTERNS));
+	return violations;
+};
+//#endregion
 //#region src/checks/instruction-symlinks.ts
 /**
 * The instruction file names checked when the options name none.
@@ -2920,6 +3094,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["migrations-directory"]),
 		check: migrationsDirectory
 	}),
+	eslint: plain({
+		name: "eslint",
+		description: "The repository's own ESLint lints the sample files with the required rules enabled at the required severity",
+		select: (checks) => enabledOptions(checks.eslint),
+		check: eslint
+	}),
 	"workflow-job-ordering": plain({
 		name: "workflow-job-ordering",
 		description: "Release, deploy and junction jobs are ordered so a failure stops what follows",
@@ -3021,6 +3201,8 @@ function compiles(source) {
 */
 const pattern = z.string().min(1).refine(compiles, "not a valid regular expression");
 const patterns = z.array(pattern);
+const severity = z.enum(["warn", "error"]);
+const requiredRules = z.record(z.string().min(1), severity);
 const selection = {
 	workflows: z.exactOptional(paths),
 	exclude: z.exactOptional(paths)
@@ -3080,6 +3262,16 @@ const checks = z.strictObject({
 		exclude: z.exactOptional(paths),
 		packageJson: z.exactOptional(path)
 	}))),
+	eslint: z.exactOptional(enabled(z.strictObject({
+		samples: z.array(z.union([path, z.strictObject({
+			path,
+			rules: z.exactOptional(requiredRules)
+		})])).min(1),
+		rules: z.exactOptional(requiredRules),
+		configFile: z.exactOptional(path),
+		lint: z.exactOptional(z.boolean()),
+		lintPatterns: z.exactOptional(paths)
+	}))),
 	"migrations-directory": z.exactOptional(enabled(z.strictObject({
 		generator: z.enum(generatorNames),
 		deployTool: z.enum(deployToolNames),

package/dist/index.cjs

@@ -5,6 +5,7 @@ let tinyglobby = require("tinyglobby");
 let ts_morph = require("ts-morph");
 let cosmiconfig_extends = require("cosmiconfig-extends");
 let node_fs_promises = require("node:fs/promises");
+let node_module = require("node:module");
 let yaml = require("yaml");
 let node_child_process = require("node:child_process");
 let jsonc_parser = require("jsonc-parser");
@@ -543,6 +544,179 @@ const dockerfilePackageManager = async ({ cwd, options }) => {
 	return violations;
 };
 //#endregion
+//#region src/checks/eslint.ts
+/**
+* The patterns the full level lints when the options name none.
+*/
+const DEFAULT_LINT_PATTERNS = ["."];
+const SEVERITY_RANK = {
+	off: 0,
+	warn: 1,
+	error: 2
+};
+function hasEslintClass(value) {
+	return isRecord(value) && typeof value["ESLint"] === "function";
+}
+/**
+* The `ESLint` class of the ESLint installed where the checks run, found the way a module in `cwd` finds it. It is not this package's own copy, so the results agree with the repository's own lint script.
+*/
+function loadEslint(cwd) {
+	const requireFromCwd = (0, node_module.createRequire)((0, node_path.join)(cwd, "package.json"));
+	try {
+		requireFromCwd.resolve("eslint");
+	} catch (error) {
+		throw new ConformanceError(`the eslint check uses the repository's own ESLint, and 'eslint' does not resolve from ${cwd}; install it there`, { cause: error });
+	}
+	const loaded = requireFromCwd("eslint");
+	if (!hasEslintClass(loaded)) throw new ConformanceError(`the 'eslint' that resolves from ${cwd} does not export the ESLint class of the Node API`);
+	return loaded.ESLint;
+}
+/**
+* The severity a rule entry resolves to. An entry is a severity or an array whose first element is one, and a severity is `0`, `1`, `2`, `'off'`, `'warn'` or `'error'`; `calculateConfigForFile` returns whichever form the config was written in.
+*/
+function normaliseSeverity(entry) {
+	const severity = Array.isArray(entry) ? entry[0] : entry;
+	if (severity === 0 || severity === "off") return "off";
+	if (severity === 1 || severity === "warn") return "warn";
+	if (severity === 2 || severity === "error") return "error";
+	throw new ConformanceError(`ESLint resolved ${JSON.stringify(entry)} as a rule entry, which is not a severity or an array that starts with one`);
+}
+/**
+* The severity of each rule in a resolved configuration.
+*/
+function resolvedSeverities(config) {
+	if (!isRecord(config)) throw new ConformanceError("ESLint resolved a configuration that is not an object");
+	const { rules } = config;
+	if (rules !== void 0 && !isRecord(rules)) throw new ConformanceError("ESLint resolved a configuration whose 'rules' is not an object");
+	return new Map(Object.entries(rules ?? {}).map(([rule, entry]) => [rule, normaliseSeverity(entry)]));
+}
+/**
+* Whether `error` is the one `calculateConfigForFile` throws when ESLint finds no config file for the path.
+*/
+function isMissingConfig(error) {
+	return isRecord(error) && error["messageTemplate"] === "config-file-missing";
+}
+function sampleOf(sample) {
+	return typeof sample === "string" ? { path: sample } : sample;
+}
+function ruleViolations(file, required, actual) {
+	return Object.entries(required).flatMap(([rule, severity]) => {
+		const found = actual.get(rule);
+		if (found === void 0) return [{
+			code: "eslint/rule-missing",
+			message: `the rule '${rule}' is not configured for ${file} (required: ${severity})`,
+			file
+		}];
+		if (found === "off") return [{
+			code: "eslint/rule-off",
+			message: `the rule '${rule}' is off for ${file} (required: ${severity})`,
+			file
+		}];
+		if (SEVERITY_RANK[found] < SEVERITY_RANK[severity]) return [{
+			code: "eslint/rule-too-weak",
+			message: `the rule '${rule}' is '${found}' for ${file} (required: ${severity})`,
+			file
+		}];
+		return [];
+	});
+}
+async function sampleViolations(eslint, sample, shared) {
+	const file = sample.path;
+	let config;
+	try {
+		config = await eslint.calculateConfigForFile(file);
+	} catch (error) {
+		if (isMissingConfig(error)) return [{
+			code: "eslint/no-config",
+			message: `ESLint finds no config file for ${file}; the check does not fall back to a config of its own`,
+			file
+		}];
+		throw new ConformanceError(`ESLint could not resolve its configuration for ${file}`, { cause: error });
+	}
+	if (config === void 0) return [{
+		code: "eslint/not-linted",
+		message: `${file} is not linted: it is ignored, or no configuration block matches it`,
+		file
+	}];
+	return ruleViolations(file, {
+		...shared,
+		...sample.rules
+	}, resolvedSeverities(config));
+}
+/**
+* Whether `error` is ESLint refusing a pattern because it selects no file that is linted.
+*/
+function isNothingLinted(error) {
+	return error instanceof Error && isRecord(error) && (error["messageTemplate"] === "file-not-found" || error["messageTemplate"] === "all-matched-files-ignored");
+}
+function messageViolation(cwd, result, message) {
+	const file = relativePosix(cwd, result.filePath);
+	const location = {
+		line: message.line,
+		column: message.column
+	};
+	if (message.ruleId !== null) {
+		const severity = message.severity === 1 ? "warn" : "error";
+		return {
+			code: `eslint/lint/${message.ruleId}`,
+			message: `${message.ruleId} (${severity}): ${message.message}`,
+			file,
+			location
+		};
+	}
+	return message.fatal === true ? {
+		code: "eslint/fatal",
+		message: message.message,
+		file,
+		location
+	} : {
+		code: "eslint/lint-message",
+		message: message.message,
+		file,
+		location
+	};
+}
+function byPosition(left, right) {
+	return left.file.localeCompare(right.file) || (left.location?.line ?? 0) - (right.location?.line ?? 0) || (left.location?.column ?? 0) - (right.location?.column ?? 0) || left.code.localeCompare(right.code);
+}
+/**
+* Lints the workspace through the Node API, with the repository's own config, and maps every message to a violation. A pattern that selects no linted file is itself a violation, since the workspace is then not linted at all.
+*/
+async function lintViolations(cwd, eslint, patterns) {
+	const violations = [];
+	const results = /* @__PURE__ */ new Map();
+	for (const pattern of patterns) try {
+		for (const result of await eslint.lintFiles([pattern])) results.set(result.filePath, result);
+	} catch (error) {
+		if (!isNothingLinted(error)) throw new ConformanceError(`ESLint could not lint '${pattern}'`, { cause: error });
+		violations.push({
+			code: "eslint/nothing-linted",
+			message: error.message,
+			file: pattern
+		});
+	}
+	for (const result of results.values()) for (const message of result.messages) violations.push(messageViolation(cwd, result, message));
+	return violations.sort(byPosition);
+}
+/**
+* Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+*
+* It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+*
+* The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+*/
+const eslint = async ({ cwd, options }) => {
+	const instance = new (loadEslint(cwd))({
+		cwd,
+		...options.configFile === void 0 ? {} : { overrideConfigFile: (0, node_path.resolve)(cwd, options.configFile) }
+	});
+	const shared = options.rules ?? {};
+	const violations = [];
+	for (const sample of options.samples.map(sampleOf)) violations.push(...await sampleViolations(instance, sample, shared));
+	if (options.lint === true) violations.push(...await lintViolations(cwd, instance, options.lintPatterns ?? DEFAULT_LINT_PATTERNS));
+	return violations;
+};
+//#endregion
 //#region src/workspace/rules.ts
 const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\]/gu;
 function escapeRegExp(text) {
@@ -2767,6 +2941,8 @@ function compiles(source) {
 */
 const pattern = zod.z.string().min(1).refine(compiles, "not a valid regular expression");
 const patterns = zod.z.array(pattern);
+const severity = zod.z.enum(["warn", "error"]);
+const requiredRules = zod.z.record(zod.z.string().min(1), severity);
 const selection = {
 	workflows: zod.z.exactOptional(paths),
 	exclude: zod.z.exactOptional(paths)
@@ -2826,6 +3002,16 @@ const checks = zod.z.strictObject({
 		exclude: zod.z.exactOptional(paths),
 		packageJson: zod.z.exactOptional(path)
 	}))),
+	eslint: zod.z.exactOptional(enabled(zod.z.strictObject({
+		samples: zod.z.array(zod.z.union([path, zod.z.strictObject({
+			path,
+			rules: zod.z.exactOptional(requiredRules)
+		})])).min(1),
+		rules: zod.z.exactOptional(requiredRules),
+		configFile: zod.z.exactOptional(path),
+		lint: zod.z.exactOptional(zod.z.boolean()),
+		lintPatterns: zod.z.exactOptional(paths)
+	}))),
 	"migrations-directory": zod.z.exactOptional(enabled(zod.z.strictObject({
 		generator: zod.z.enum(generatorNames),
 		deployTool: zod.z.enum(deployToolNames),
@@ -3100,6 +3286,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["migrations-directory"]),
 		check: migrationsDirectory
 	}),
+	eslint: plain({
+		name: "eslint",
+		description: "The repository's own ESLint lints the sample files with the required rules enabled at the required severity",
+		select: (checks) => enabledOptions(checks.eslint),
+		check: eslint
+	}),
 	"workflow-job-ordering": plain({
 		name: "workflow-job-ordering",
 		description: "Release, deploy and junction jobs are ordered so a failure stops what follows",
@@ -3402,6 +3594,7 @@ exports.deployTools = deployTools;
 exports.dockerfilePackageManager = dockerfilePackageManager;
 exports.effectiveEnv = effectiveEnv;
 exports.effectivePermissions = effectivePermissions;
+exports.eslint = eslint;
 exports.generators = generators;
 exports.handlerCases = handlerCases;
 exports.importCrossSlice = importCrossSlice;

package/dist/index.d.cts

@@ -474,6 +474,48 @@ interface DockerfilePackageManagerOptions {
    */
   readonly packageJson?: string;
 }
+/**
+ * The severity a rule must have at least: `warn` is met by `warn` or `error`, `error` only by `error`.
+ */
+type EslintRequiredSeverity = "warn" | "error";
+/**
+ * A file whose resolved ESLint configuration is checked.
+ */
+interface EslintSample {
+  /**
+   * The file ESLint would lint, relative to the directory the checks run in. It need not exist: ESLint resolves a file's configuration from its path alone.
+   */
+  readonly path: string;
+  /**
+   * Rules required for this file on top of the check's `rules`, which this file's entries override.
+   */
+  readonly rules?: Readonly<Record<string, EslintRequiredSeverity>>;
+}
+/**
+ * Options of the `eslint` check: the repository's own ESLint, resolved from the directory the checks run in, lints the sample files with the required rules.
+ */
+interface EslintOptions {
+  /**
+   * One file per kind of source the repository lints (`src/index.ts`, `package.json`, `eslint.config.ts`). A bare string is `{ path }`. Each must be linted: not ignored, and matched by a configuration block.
+   */
+  readonly samples: readonly (string | EslintSample)[];
+  /**
+   * Rules required for every sample, with the severity each must have at least.
+   */
+  readonly rules?: Readonly<Record<string, EslintRequiredSeverity>>;
+  /**
+   * The config file under test, relative to the directory the checks run in, instead of the one ESLint finds from there.
+   */
+  readonly configFile?: string;
+  /**
+   * Also lint the workspace and report every message ESLint produces. Off when omitted: the default level lints nothing and only reads resolved configuration.
+   */
+  readonly lint?: boolean;
+  /**
+   * What the full level lints, as file and directory patterns relative to the directory the checks run in. `.` when omitted. Used only with `lint`.
+   */
+  readonly lintPatterns?: readonly string[];
+}
 /**
  * Options of the `migrations-directory` check: the directory a schema generator writes migrations to is the one the deploy tool applies them from, and no script applies them with the generator.
  */
@@ -672,6 +714,7 @@ interface CheckOptionsByName {
   readonly "commit-types": CommitTypesOptions;
   readonly "dockerfile-package-manager": DockerfilePackageManagerOptions;
   readonly "migrations-directory": MigrationsDirectoryOptions;
+  readonly eslint: EslintOptions;
   readonly "workflow-job-ordering": WorkflowJobOrderingOptions;
   readonly "workflow-skippable-jobs": WorkflowSkippableJobsOptions;
   readonly "workflow-runner-resolution": WorkflowRunnerResolutionOptions;
@@ -730,6 +773,16 @@ export declare const commitTypes: CheckFunction<CommitTypesOptions>;
  */
 export declare const dockerfilePackageManager: CheckFunction<DockerfilePackageManagerOptions>;
 //#endregion
+//#region src/checks/eslint.d.ts
+/**
+ * Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+ *
+ * It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+ *
+ * The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+ */
+export declare const eslint: CheckFunction<EslintOptions>;
+//#endregion
 //#region src/workspace/packages.d.ts
 /**
  * A package directory found under the workspace root, before the layout classifies it.
@@ -1222,4 +1275,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DiscoveredPackage, DockerfilePackageManagerOptions, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DiscoveredPackage, DockerfilePackageManagerOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };

package/dist/index.d.ts

@@ -474,6 +474,48 @@ interface DockerfilePackageManagerOptions {
    */
   readonly packageJson?: string;
 }
+/**
+ * The severity a rule must have at least: `warn` is met by `warn` or `error`, `error` only by `error`.
+ */
+type EslintRequiredSeverity = "warn" | "error";
+/**
+ * A file whose resolved ESLint configuration is checked.
+ */
+interface EslintSample {
+  /**
+   * The file ESLint would lint, relative to the directory the checks run in. It need not exist: ESLint resolves a file's configuration from its path alone.
+   */
+  readonly path: string;
+  /**
+   * Rules required for this file on top of the check's `rules`, which this file's entries override.
+   */
+  readonly rules?: Readonly<Record<string, EslintRequiredSeverity>>;
+}
+/**
+ * Options of the `eslint` check: the repository's own ESLint, resolved from the directory the checks run in, lints the sample files with the required rules.
+ */
+interface EslintOptions {
+  /**
+   * One file per kind of source the repository lints (`src/index.ts`, `package.json`, `eslint.config.ts`). A bare string is `{ path }`. Each must be linted: not ignored, and matched by a configuration block.
+   */
+  readonly samples: readonly (string | EslintSample)[];
+  /**
+   * Rules required for every sample, with the severity each must have at least.
+   */
+  readonly rules?: Readonly<Record<string, EslintRequiredSeverity>>;
+  /**
+   * The config file under test, relative to the directory the checks run in, instead of the one ESLint finds from there.
+   */
+  readonly configFile?: string;
+  /**
+   * Also lint the workspace and report every message ESLint produces. Off when omitted: the default level lints nothing and only reads resolved configuration.
+   */
+  readonly lint?: boolean;
+  /**
+   * What the full level lints, as file and directory patterns relative to the directory the checks run in. `.` when omitted. Used only with `lint`.
+   */
+  readonly lintPatterns?: readonly string[];
+}
 /**
  * Options of the `migrations-directory` check: the directory a schema generator writes migrations to is the one the deploy tool applies them from, and no script applies them with the generator.
  */
@@ -672,6 +714,7 @@ interface CheckOptionsByName {
   readonly "commit-types": CommitTypesOptions;
   readonly "dockerfile-package-manager": DockerfilePackageManagerOptions;
   readonly "migrations-directory": MigrationsDirectoryOptions;
+  readonly eslint: EslintOptions;
   readonly "workflow-job-ordering": WorkflowJobOrderingOptions;
   readonly "workflow-skippable-jobs": WorkflowSkippableJobsOptions;
   readonly "workflow-runner-resolution": WorkflowRunnerResolutionOptions;
@@ -730,6 +773,16 @@ export declare const commitTypes: CheckFunction<CommitTypesOptions>;
  */
 export declare const dockerfilePackageManager: CheckFunction<DockerfilePackageManagerOptions>;
 //#endregion
+//#region src/checks/eslint.d.ts
+/**
+ * Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+ *
+ * It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+ *
+ * The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+ */
+export declare const eslint: CheckFunction<EslintOptions>;
+//#endregion
 //#region src/workspace/packages.d.ts
 /**
  * A package directory found under the workspace root, before the layout classifies it.
@@ -1222,4 +1275,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DiscoveredPackage, DockerfilePackageManagerOptions, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DiscoveredPackage, DockerfilePackageManagerOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };

package/dist/index.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { escapePath, glob, isDynamicPattern } from "tinyglobby";
@@ -542,6 +543,179 @@ const dockerfilePackageManager = async ({ cwd, options }) => {
 	return violations;
 };
 //#endregion
+//#region src/checks/eslint.ts
+/**
+* The patterns the full level lints when the options name none.
+*/
+const DEFAULT_LINT_PATTERNS = ["."];
+const SEVERITY_RANK = {
+	off: 0,
+	warn: 1,
+	error: 2
+};
+function hasEslintClass(value) {
+	return isRecord(value) && typeof value["ESLint"] === "function";
+}
+/**
+* The `ESLint` class of the ESLint installed where the checks run, found the way a module in `cwd` finds it. It is not this package's own copy, so the results agree with the repository's own lint script.
+*/
+function loadEslint(cwd) {
+	const requireFromCwd = createRequire(join(cwd, "package.json"));
+	try {
+		requireFromCwd.resolve("eslint");
+	} catch (error) {
+		throw new ConformanceError(`the eslint check uses the repository's own ESLint, and 'eslint' does not resolve from ${cwd}; install it there`, { cause: error });
+	}
+	const loaded = requireFromCwd("eslint");
+	if (!hasEslintClass(loaded)) throw new ConformanceError(`the 'eslint' that resolves from ${cwd} does not export the ESLint class of the Node API`);
+	return loaded.ESLint;
+}
+/**
+* The severity a rule entry resolves to. An entry is a severity or an array whose first element is one, and a severity is `0`, `1`, `2`, `'off'`, `'warn'` or `'error'`; `calculateConfigForFile` returns whichever form the config was written in.
+*/
+function normaliseSeverity(entry) {
+	const severity = Array.isArray(entry) ? entry[0] : entry;
+	if (severity === 0 || severity === "off") return "off";
+	if (severity === 1 || severity === "warn") return "warn";
+	if (severity === 2 || severity === "error") return "error";
+	throw new ConformanceError(`ESLint resolved ${JSON.stringify(entry)} as a rule entry, which is not a severity or an array that starts with one`);
+}
+/**
+* The severity of each rule in a resolved configuration.
+*/
+function resolvedSeverities(config) {
+	if (!isRecord(config)) throw new ConformanceError("ESLint resolved a configuration that is not an object");
+	const { rules } = config;
+	if (rules !== void 0 && !isRecord(rules)) throw new ConformanceError("ESLint resolved a configuration whose 'rules' is not an object");
+	return new Map(Object.entries(rules ?? {}).map(([rule, entry]) => [rule, normaliseSeverity(entry)]));
+}
+/**
+* Whether `error` is the one `calculateConfigForFile` throws when ESLint finds no config file for the path.
+*/
+function isMissingConfig(error) {
+	return isRecord(error) && error["messageTemplate"] === "config-file-missing";
+}
+function sampleOf(sample) {
+	return typeof sample === "string" ? { path: sample } : sample;
+}
+function ruleViolations(file, required, actual) {
+	return Object.entries(required).flatMap(([rule, severity]) => {
+		const found = actual.get(rule);
+		if (found === void 0) return [{
+			code: "eslint/rule-missing",
+			message: `the rule '${rule}' is not configured for ${file} (required: ${severity})`,
+			file
+		}];
+		if (found === "off") return [{
+			code: "eslint/rule-off",
+			message: `the rule '${rule}' is off for ${file} (required: ${severity})`,
+			file
+		}];
+		if (SEVERITY_RANK[found] < SEVERITY_RANK[severity]) return [{
+			code: "eslint/rule-too-weak",
+			message: `the rule '${rule}' is '${found}' for ${file} (required: ${severity})`,
+			file
+		}];
+		return [];
+	});
+}
+async function sampleViolations(eslint, sample, shared) {
+	const file = sample.path;
+	let config;
+	try {
+		config = await eslint.calculateConfigForFile(file);
+	} catch (error) {
+		if (isMissingConfig(error)) return [{
+			code: "eslint/no-config",
+			message: `ESLint finds no config file for ${file}; the check does not fall back to a config of its own`,
+			file
+		}];
+		throw new ConformanceError(`ESLint could not resolve its configuration for ${file}`, { cause: error });
+	}
+	if (config === void 0) return [{
+		code: "eslint/not-linted",
+		message: `${file} is not linted: it is ignored, or no configuration block matches it`,
+		file
+	}];
+	return ruleViolations(file, {
+		...shared,
+		...sample.rules
+	}, resolvedSeverities(config));
+}
+/**
+* Whether `error` is ESLint refusing a pattern because it selects no file that is linted.
+*/
+function isNothingLinted(error) {
+	return error instanceof Error && isRecord(error) && (error["messageTemplate"] === "file-not-found" || error["messageTemplate"] === "all-matched-files-ignored");
+}
+function messageViolation(cwd, result, message) {
+	const file = relativePosix(cwd, result.filePath);
+	const location = {
+		line: message.line,
+		column: message.column
+	};
+	if (message.ruleId !== null) {
+		const severity = message.severity === 1 ? "warn" : "error";
+		return {
+			code: `eslint/lint/${message.ruleId}`,
+			message: `${message.ruleId} (${severity}): ${message.message}`,
+			file,
+			location
+		};
+	}
+	return message.fatal === true ? {
+		code: "eslint/fatal",
+		message: message.message,
+		file,
+		location
+	} : {
+		code: "eslint/lint-message",
+		message: message.message,
+		file,
+		location
+	};
+}
+function byPosition(left, right) {
+	return left.file.localeCompare(right.file) || (left.location?.line ?? 0) - (right.location?.line ?? 0) || (left.location?.column ?? 0) - (right.location?.column ?? 0) || left.code.localeCompare(right.code);
+}
+/**
+* Lints the workspace through the Node API, with the repository's own config, and maps every message to a violation. A pattern that selects no linted file is itself a violation, since the workspace is then not linted at all.
+*/
+async function lintViolations(cwd, eslint, patterns) {
+	const violations = [];
+	const results = /* @__PURE__ */ new Map();
+	for (const pattern of patterns) try {
+		for (const result of await eslint.lintFiles([pattern])) results.set(result.filePath, result);
+	} catch (error) {
+		if (!isNothingLinted(error)) throw new ConformanceError(`ESLint could not lint '${pattern}'`, { cause: error });
+		violations.push({
+			code: "eslint/nothing-linted",
+			message: error.message,
+			file: pattern
+		});
+	}
+	for (const result of results.values()) for (const message of result.messages) violations.push(messageViolation(cwd, result, message));
+	return violations.sort(byPosition);
+}
+/**
+* Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+*
+* It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+*
+* The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+*/
+const eslint = async ({ cwd, options }) => {
+	const instance = new (loadEslint(cwd))({
+		cwd,
+		...options.configFile === void 0 ? {} : { overrideConfigFile: resolve(cwd, options.configFile) }
+	});
+	const shared = options.rules ?? {};
+	const violations = [];
+	for (const sample of options.samples.map(sampleOf)) violations.push(...await sampleViolations(instance, sample, shared));
+	if (options.lint === true) violations.push(...await lintViolations(cwd, instance, options.lintPatterns ?? DEFAULT_LINT_PATTERNS));
+	return violations;
+};
+//#endregion
 //#region src/workspace/rules.ts
 const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\]/gu;
 function escapeRegExp(text) {
@@ -2766,6 +2940,8 @@ function compiles(source) {
 */
 const pattern = z.string().min(1).refine(compiles, "not a valid regular expression");
 const patterns = z.array(pattern);
+const severity = z.enum(["warn", "error"]);
+const requiredRules = z.record(z.string().min(1), severity);
 const selection = {
 	workflows: z.exactOptional(paths),
 	exclude: z.exactOptional(paths)
@@ -2825,6 +3001,16 @@ const checks = z.strictObject({
 		exclude: z.exactOptional(paths),
 		packageJson: z.exactOptional(path)
 	}))),
+	eslint: z.exactOptional(enabled(z.strictObject({
+		samples: z.array(z.union([path, z.strictObject({
+			path,
+			rules: z.exactOptional(requiredRules)
+		})])).min(1),
+		rules: z.exactOptional(requiredRules),
+		configFile: z.exactOptional(path),
+		lint: z.exactOptional(z.boolean()),
+		lintPatterns: z.exactOptional(paths)
+	}))),
 	"migrations-directory": z.exactOptional(enabled(z.strictObject({
 		generator: z.enum(generatorNames),
 		deployTool: z.enum(deployToolNames),
@@ -3099,6 +3285,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["migrations-directory"]),
 		check: migrationsDirectory
 	}),
+	eslint: plain({
+		name: "eslint",
+		description: "The repository's own ESLint lints the sample files with the required rules enabled at the required severity",
+		select: (checks) => enabledOptions(checks.eslint),
+		check: eslint
+	}),
 	"workflow-job-ordering": plain({
 		name: "workflow-job-ordering",
 		description: "Release, deploy and junction jobs are ordered so a failure stops what follows",
@@ -3380,4 +3572,4 @@ function proveExhaustive(input) {
 	}) };
 }
 //#endregion
-export { ConformanceError, DEFAULT_INFERENCES, DEFAULT_WORKFLOWS, EXIT_CODES, ExhaustivenessError, PRESET_COMMIT_TYPES, accessOf, aggregateMappers, checkNames, classifyPackages, commandTypes, commitTypes, conformanceSchema, conformanceSection, createGitHubClient, crossSliceRules, cycleRule, deployTools, dockerfilePackageManager, effectiveEnv, effectivePermissions, generators, handlerCases, importCrossSlice, importCycles, importIsolatedGroups, importRankSkip, importUphill, instructionSymlinks, isCheckName, isolatedGroupRules, loadWorkflows, migrationsDirectory, packagesPattern, parseUses, parseWorkflow, proveExhaustive, rankSkipRules, registry, removeCase, runChecks, settingsMergeMethods, settingsRequiredChecks, settingsReviewThreadResolution, singleStorybook, transitiveNeeds, typeErrors, uphillRules, workflowActionPinning, workflowCredentials, workflowJobOrdering, workflowMergeGroup, workflowRepositoryDispatch, workflowRunnerResolution, workflowSkippableJobs, workflowUpdateBotCooldown, workflowVersionSingleSource };
+export { ConformanceError, DEFAULT_INFERENCES, DEFAULT_WORKFLOWS, EXIT_CODES, ExhaustivenessError, PRESET_COMMIT_TYPES, accessOf, aggregateMappers, checkNames, classifyPackages, commandTypes, commitTypes, conformanceSchema, conformanceSection, createGitHubClient, crossSliceRules, cycleRule, deployTools, dockerfilePackageManager, effectiveEnv, effectivePermissions, eslint, generators, handlerCases, importCrossSlice, importCycles, importIsolatedGroups, importRankSkip, importUphill, instructionSymlinks, isCheckName, isolatedGroupRules, loadWorkflows, migrationsDirectory, packagesPattern, parseUses, parseWorkflow, proveExhaustive, rankSkipRules, registry, removeCase, runChecks, settingsMergeMethods, settingsRequiredChecks, settingsReviewThreadResolution, singleStorybook, transitiveNeeds, typeErrors, uphillRules, workflowActionPinning, workflowCredentials, workflowJobOrdering, workflowMergeGroup, workflowRepositoryDispatch, workflowRunnerResolution, workflowSkippableJobs, workflowUpdateBotCooldown, workflowVersionSingleSource };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "workspace-conformance",
   "description": "Conformance checks for a pnpm workspace that ESLint cannot express: type-graph, import-graph and cross-file checks driven by the shared layout section of @exadev/config",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "bin": {
     "workspace-conformance": "./dist/cli.js"
   },
@@ -72,8 +72,14 @@
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "peerDependencies": {
     "cosmiconfig": "^9.0.0 || ^10.0.0",
+    "eslint": "^9.0.0 || ^10.0.0",
     "typescript": "^5.9.0 || ^6.0.0"
   },
+  "peerDependenciesMeta": {
+    "eslint": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public",
     "provenance": true