src/protected-paths.ts

Functions

Imports

It imports no other module of this repo. Imported by src/scope.ts.

Source

1// The paths a repo write needs can_touch_protected for (src/scope.ts): tests, CI, the
2// dependency manifests and lockfiles, migrations, deployment and compiler config, the
3// agent steering layer and anything else that changes what judges a change rather than
4// the change itself.
5//
6// Matched by shape, not today's spellings, so a sixth repo's layout is covered.
7const PROTECTED_PATH_PATTERNS: Array<{ pattern: RegExp; why: string }> = [
8  { pattern: /(^|\/)tests?\//i, why: "a test directory" },
9  { pattern: /\.(test|spec)\.[cm]?[jt]sx?$/i, why: "a test file" },
10  { pattern: /(^|\/)__tests__\//i, why: "a test directory" },
11  { pattern: /(^|\/)\.github\//i, why: "CI configuration" },
12  { pattern: /(^|\/)migrations\//i, why: "a database migration" },
13  { pattern: /(^|\/)wrangler\.(jsonc?|toml)(\.example)?$/i, why: "deployment configuration" },
14  { pattern: /(^|\/)package(-lock)?\.json$/i, why: "the dependency manifest or lockfile" },
15  { pattern: /(^|\/)npm-shrinkwrap\.json$/i, why: "a lockfile npm prefers over package-lock.json" },
16  { pattern: /(^|\/)pnpm-lock\.yaml$/i, why: "the pnpm lockfile CI installs from" },
17  { pattern: /(^|\/)pnpm-workspace\.yaml$/i, why: "the pnpm workspace definition" },
18  { pattern: /(^|\/)\.pnpmfile\.cjs$/i, why: "a pnpm hook that runs during install" },
19  { pattern: /(^|\/)yarn\.lock$/i, why: "the yarn lockfile" },
20  { pattern: /(^|\/)\.yarnrc\.yml$/i, why: "yarn registry and install policy" },
21  { pattern: /(^|\/)bun\.lockb?$/i, why: "the bun lockfile" },
22  { pattern: /(^|\/)deno\.lock$/i, why: "the deno lockfile" },
23  { pattern: /(^|\/)Cargo\.lock$/i, why: "the cargo lockfile" },
24  { pattern: /(^|\/)go\.sum$/i, why: "the go module checksums" },
25  { pattern: /(^|\/)(poetry|uv)\.lock$/i, why: "a python lockfile" },
26  // The other ecosystems' lockfiles and task runners (Grok audit 2026-10-21, CA-11).
27  { pattern: /(^|\/)(Pipfile\.lock|requirements[^/]*\.txt)$/i, why: "a python lockfile" },
28  { pattern: /(^|\/)(Gemfile\.lock|composer\.lock|flake\.lock|Package\.resolved|gradle\.lockfile)$/i, why: "a lockfile" },
29  { pattern: /(^|\/)(justfile|Taskfile\.ya?ml)$/i, why: "build glue CI executes" },
30  { pattern: /(^|\/)\.gitmodules$/i, why: "submodules the checkout would fetch and run" },
31  { pattern: /(^|\/)tsconfig[^/]*\.json$/i, why: "compiler configuration" },
32  { pattern: /\.(config|conf)\.[cm]?[jt]s$/i, why: "a config file" },
33  { pattern: /(^|\/)\.?eslint[^/]*$/i, why: "lint configuration" },
34  { pattern: /(^|\/)\.claude\//i, why: "the agent steering layer" },
35  { pattern: /(^|\/)CLAUDE\.md$/i, why: "the repo briefing" },
36  { pattern: /(^|\/)AGENTS\.md$/i, why: "the repo briefing other agents read" },
37  { pattern: /(^|\/)\.nvmrc$/i, why: "the Node version CI runs" },
38  { pattern: /(^|\/)\.node-version$/i, why: "the Node version CI runs" },
39  { pattern: /(^|\/)\.npmrc$/i, why: "npm registry and install-script policy" },
40  { pattern: /(^|\/)\.yarnrc[^/]*$/i, why: "yarn registry and install policy" },
41  { pattern: /(^|\/)\.tool-versions$/i, why: "the toolchain versions asdf resolves" },
42  { pattern: /(^|\/)\.gitattributes$/i, why: "what the checkout contains" },
43  { pattern: /(^|\/)\.husky\//i, why: "a git hook CI may run" },
44  { pattern: /(^|\/)scripts\//i, why: "scripts CI executes" },
45  { pattern: /(^|\/)Makefile$/i, why: "build glue CI executes" },
46  // Config the test runner or build reads that is JSON, a dotfile or has no extension.
47  { pattern: /\.(config|conf)\.json$/i, why: "a config file" },
48  { pattern: /(^|\/)\.babelrc[^/]*$/i, why: "compiler configuration" },
49  { pattern: /(^|\/)\.mocharc[^/]*$/i, why: "test runner configuration" },
50  { pattern: /(^|\/)vitest\.workspace\.[^/]+$/i, why: "test runner configuration" },
51  { pattern: /(^|\/)\.env[^/]*$/i, why: "environment the build and tests read" },
52  { pattern: /(^|\/)Dockerfile[^/]*$/i, why: "the image a build runs in" },
53];
54
55// Returns the reasons a change set is disqualified, or an empty array.
56export function protectedHits(paths: string[]): Array<{ path: string; why: string }> {
57  const hits: Array<{ path: string; why: string }> = [];
58  for (const path of paths) {
59    for (const { pattern, why } of PROTECTED_PATH_PATTERNS) {
60      if (pattern.test(path)) {
61        hits.push({ path, why });
62        break;
63      }
64    }
65  }
66  return hits;
67}