OptionalrequiresThe check reviews a diff and has nothing to say without one. Declared here
rather than folded into applies so the orchestrator can tell the two kinds
of "not applicable" apart:
Before this existed, both simply vanished — so a shallow clone removed most of the security surface and still printed a clean, complete-looking report.
OptionalweightThe check spawns something expensive — a whole-project analyser like knip, jscpd, dpdm, tsc or grype. The orchestrator admits only a couple of these at once, independently of the overall concurrency limit: four regex scans in parallel are free, four project-wide analysers are not.
A single quality gate.
appliesdecides relevance (language/marker gating);runperforms the check and returns an outcome.runmust NOT throw for violations — returnfail/warninstead. Thrown errors are caught by the orchestrator and recorded asfail.