[leftibot]

Closes #65. First step of Phase 4 in #107.

project_validator/ecosystems/javascript.py judges npm-compatible projects (package.json: npm, pnpm, yarn, bun) and Deno projects (deno.json / deno.jsonc). The ecosystem's label is JavaScript/TypeScript, and it covers two languages: .js .mjs .cjs .jsx count as JavaScript, and .ts .mts .cts .tsx as TypeScript.

Practice	Passes when
tests-run	*.test.*, *.spec.*, *_test.* (Deno) or __tests__/ files exist, and jest, vitest, mocha, ava, node --test, deno test, bun test, playwright or npm test runs them
coverage	c8, nyc, jest --coverage / collectCoverage: true, vitest --coverage / coverage enabled: true, deno test --coverage or node --experimental-test-coverage is used (all of them report branches)
code-formatting	CI runs prettier --check, biome format / check / ci, deno fmt --check or dprint check. All of them have a default style
compiler-warnings	a linter runs: eslint, biome or deno lint
warnings-as-errors	eslint --max-warnings 0, biome ci / --error-on-warnings, or deno lint
dependency-audit	npm audit (not npm audit signatures), pnpm audit, yarn (npm) audit or bun audit runs
security-scanning	eslint-plugin-security (or @microsoft/eslint-plugin-sdl) is used, or semgrep runs with a JavaScript ruleset
function-limits	lizard runs, or eslint runs with max-lines-per-function enabled. It warns when the rule is enabled but eslint never runs
static-analysis	eslint, biome lint or deno lint runs
type-checking	tsc / vue-tsc, deno check or deno test runs. Bonus: "strict": true or @tsconfig/strictest in tsconfig.json / jsconfig.json, or a Deno project, which is strict unless "strict": false
dependency-management	dependencies in package.json (or imports in deno.json) are locked by a committed package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock(b) or deno.lock
license	the license file matches license in package.json
vcs-ignore / committed-artifacts	node_modules/ is ignored. node_modules/, a top-level coverage/ and *.tsbuildinfo must not be committed
platform-matrix	CI runs at least two Node.js, Deno or Bun versions (node-version, deno-version, bun-version, node: / denoland/deno: / oven/bun: images)

hardening and ci-build-types do not apply, because JavaScript builds no native binary.

How a project is recognised. Many projects in other languages have a package.json just for their tooling, so that file alone does not make a JavaScript project. It counts only when it names entry points (main, module, exports or bin), or when JavaScript or TypeScript sources exist outside node_modules. deno.json always counts.

Package scripts count as CI. JavaScript tools mostly run through package scripts (npm run lint), not straight from CI. So when CI or a pre-commit hook runs a script, its text counts as evidence too. This covers npm run lint, npm test, pnpm lint, yarn run x, bun run x and deno task x, plus their pre/post scripts and any scripts they call in turn. A script that CI never runs counts for nothing.

Changes outside the profile (please review)

#107 says nothing in project_validator/checks/ should change for a new ecosystem. Two small, language-agnostic changes were needed:

• Formatter gets an optional texts. Before, code-formatting searched only CI configuration, so npm run format:check would always fail. The default is still CI configuration, so every existing profile behaves exactly as before. The check now reads formatter.texts(context), a one-line change.
• The JSON-with-comments reader moves from checks/data_wellformed.py to text.strip_json_comments. Profiles can now read tsconfig.json and deno.jsonc with the new evidence.json_value, which mirrors toml_value. data-wellformed behaves the same.

Deviations from #65 (please confirm)

• No coverage bonus for JavaScript. Branch coverage is required, and the only bonus is path coverage, which is expensive and rarely reported. A branches threshold (Add a JavaScript/TypeScript ecosystem profile (Node, Deno, Bun) #65) is not path coverage, so it earns no bonus. Neither Istanbul nor V8 reports path coverage, so this profile has no path patterns and no path hint.
• Lockfile only. Add a JavaScript/TypeScript ecosystem profile (Node, Deno, Bun) #65 also asks that CI installs from the lockfile (npm ci, --frozen-lockfile, --immutable). That is not judged:
  • DependencyManagement has no place for it.
  • pnpm and yarn (berry) already install frozen in CI by default, so a missing flag proves nothing.
  • The hint still suggests the frozen installs.
• Libraries must lock too. Add dependency-management check: dependencies come from a package manager #24's open question is whether libraries are exempt. A package's lockfile is never published, so npm's own guidance is to commit it in libraries as well. Rust exempts library crates; this profile does not.
• dist/ may be committed. It is suggested as an ignore entry, but it is not a committed-artifacts failure, because a JavaScript GitHub Action has to commit its bundle.
• Phase 3 rows are in. The type-checking and dependency-management rows of Add a JavaScript/TypeScript ecosystem profile (Node, Deno, Bun) #65, marked later, are included now that those checks exist, as Action plan: order of execution for the ecosystem roadmap and strict self-validation #107's Phase 3 intended. So are static-analysis and license.

Tests

• tests/fixtures/well_configured_javascript passes every check that applies to it. tests/fixtures/bare_javascript fails or warns on every JavaScript practice (tests/test_ecosystem_contract.py).
• tests/test_javascript.py covers recognition, script following, and each rule.
• Two new layouts in tests/support.py: npm JavaScript and Deno TypeScript.
• In the existing snapshots, only the "applies to" lists inside SKIP messages change. No CI job is attributed differently. npx alone is not treated as JavaScript usage, because other ecosystems' CI runs jscpd with it.

Local gates all pass:

• python -W error -m unittest (624 tests)
• ruff check and format
• strict mypy
• branch coverage 99% (new profile 100%)
• lizard --length 30
• jscpd: 0 clones
• project-validator --strict --exclude tests/fixtures .

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.83%. Comparing base (7f93afa) to head (544eddd).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #124      +/-   ##
==========================================
+ Coverage   98.51%   98.83%   +0.31%     
==========================================
  Files          58       64       +6     
  Lines        2297     2928     +631     
  Branches      231      281      +50     
==========================================
+ Hits         2263     2894     +631     
  Misses         28       28              
  Partials        6        6              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.