0.5.0

Highlights

Three new commands, and every one of them exists because a repository can pass check and still be unsafe.

ever-better tier — every rule an error, and the list may only shrink

freeze records today's violations and stays silent about them. That is the right default and it cannot put a squiggle under the line somebody is editing.

tier answers the same question the other way. Every rule stays an error; the file-and-rule pairs failing today become warnings in a generated eslint-tier.config.mjs. Fix what a file is listed for, run it again, and the entry disappears — the rules get stricter with nobody editing a config.

ever-better tier            # take a tier, and record it
ever-better tier --check    # compare against the ledger, write nothing  (for CI)

.ever-better/tier.json records a count per pair, because a files-scoped block downgrades the whole pair — a second violation of a rule a file is already excused for would otherwise be a warning nobody fails on. tier --check is the CI gate: it writes nothing into the repository, so it runs on a read-only checkout and leaves git status clean. Before recording anything, both paths run ESLint and confirm no rule the list excuses is still reported as an error — text that looks like wiring is not the same as wiring that works.

ever-better secrets — the one check with no baseline

Scans the whole git history with gitleaks. A leaked key cannot be grandfathered: it is either in the history or it is not, so this command has no ceiling to raise and no baseline to pin. bootstrap also generates a secret-scan.yml workflow.

ever-better report — where the findings are, not just how many

status says how big the backlog is. report says where it is — per rule and per area, as markdown, for a CI job comment.

What else changed

• eslint-disable is now banned in generated configs (#57). An inline disable comment is an exemption the ratchet cannot see or reclaim, so a repo could drain its baseline to zero while the violations moved into comments. Generated configs now set noInlineConfig alongside reportUnusedDisableDirectives, and ban any, as casts, @ts-ignore and @ts-expect-error.
• Generated files are what Prettier would write (#67). The generated eslint.config.js failed the prettier/prettier rule it switches on, so every repository that ran bootstrap started with a violation the tool itself wrote. Fixed, and pinned by a test that runs Prettier over every generated sample.
• bootstrap no longer reformats package.json (#48), and will not overwrite a knip script somebody else wrote.
• CI detection understands yarn run lint (#62). A workflow step written as yarn run lint rather than yarn lint was read as "no lint in CI", so diagnose reported a gap that was not there.
• node:test is detected whatever launches node (#63) — node --test, a wrapper script, or a runner flag buried in a longer command.
• A solution-style tsconfig.json is followed to the project that compiles the code (#64). A root tsconfig holding only references has no options to read, and reading it as the project reported every strictness flag as absent.
• Dependency updates: eslint group (#54, #59), knip (#55), js-yaml (#60).
• ChangeLog for 0.4.1 (#46).

Upgrade notes

Nothing in this release changes an existing freeze/check workflow. tier is an alternative to freeze, not a layer on it — do not run both, as a violation downgraded to warn moves out of the suppression ledger into the warning population. Configs generated by earlier versions are unchanged until you re-run bootstrap.

📦 npm: ever-better@0.5.0

---

What's Changed

• docs: ChangeLog for 0.4.1 by @isamu in #46
• fix: bootstrap reformatted package.json, and could overwrite a knip script by @isamu in #48
• feat: ever-better report — where the findings are, not just how many by @isamu in #52
• feat: secret scanning — the one check with no baseline by @isamu in #53
• chore(deps-dev): Bump knip from 6.32.0 to 6.32.2 in the dev group by @dependabot[bot] in #55
• chore(deps-dev): Bump the eslint group with 2 updates by @dependabot[bot] in #54
• fix: an eslint-disable comment is an exemption the ratchet cannot see by @isamu in #57
• fix: a script run as yarn run lint is still lint running in CI by @isamu in #62
• fix: node:test is the runner whatever launches node by @isamu in #63
• fix: a solution-style tsconfig holds no options, so read the project that compiles the code by @isamu in #64
• chore(deps-dev): Bump globals from 17.10.0 to 17.11.0 in the eslint group by @dependabot[bot] in #59
• chore(deps-dev): Bump js-yaml from 5.2.3 to 5.3.0 in the dev group by @dependabot[bot] in #60
• feat: ever-better tier — every rule an error, the files that trip one downgraded to warn by @isamu in #65
• fix: generated files are what Prettier would write by @isamu in #67

Full Changelog: 0.4.1...0.5.0