fix(ci): make qlty check actually analyze files

.github/workflows/ci.yml

@@ -65,7 +65,10 @@ jobs:
   qlty:
     name: Qlty Check
     runs-on: ubuntu-latest
-    timeout-minutes: 3
+    timeout-minutes: 10
+    env:
+      # Empty off a pull request, where the full-tree mode below runs instead.
+      UPSTREAM_REF: origin/${{ github.base_ref }}
 
     steps:
       - name: Checkout code
@@ -78,10 +81,26 @@ jobs:
         uses: qltysh/qlty-action/install@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0
 
       - name: Run qlty check
-        run: qlty check
+        # qlty analyzes changed files only and needs an explicit base: actions/checkout
+        # leaves pull requests on a detached merge ref with no local branch, so qlty
+        # compares HEAD against itself and analyzes nothing. Off a pull request there is
+        # no base to compare against at all, so the whole tree is scanned instead —
+        # osv-scanner stays out of that filter because the step below reports its
+        # findings rather than gating on them.
+        run: qlty check ${{ github.event_name == 'pull_request' && '--upstream "$UPSTREAM_REF"' || '--all --filter=actionlint,trufflehog' }}
 
       - name: Run qlty code smells analysis
-        run: qlty smells
+        # A custom `if:` still carries an implicit success(), so !cancelled() is what
+        # keeps this running when the check above fails.
+        if: "!cancelled() && github.event_name == 'pull_request'"
+        run: qlty smells --upstream "$UPSTREAM_REF"
+
+      # The osv-scanner plugin declares skip_upstream, so changed-file runs drop it
+      # entirely; --all is the only mode in which it ever sees a lockfile. Reporting
+      # only until the vulnerabilities it finds today are triaged.
+      - name: Run qlty dependency scan
+        if: '!cancelled()'
+        run: qlty check --all --filter=osv-scanner --no-fail
 
   build:
     name: Build & Test

.qlty/qlty.toml

@@ -2,6 +2,16 @@
 # Learn more at https://docs.qlty.sh
 config_version = "0"
 
+# Exclusion patterns. Must stay above every table header: a bare key after
+# `[[plugin]]`/`[[source]]` binds to that table and qlty silently drops it.
+exclude_patterns = [
+  "node_modules/**",
+  "dist/**",
+  "coverage/**",
+  "**/*.min.js",
+  "**/*.min.css",
+]
+
 # Plugins configuration
 [[plugin]]
 name = "actionlint"
@@ -17,17 +27,6 @@ name = "osv-scanner"
 name = "default"
 default = true
 
-# Exclusion patterns
-exclude_patterns = [
-  "node_modules/**",
-  "dist/**",
-  "build/**",
-  "coverage/**",
-  "**/*.min.js",
-  "**/*.min.css",
-  ".git/**",
-]
-
 # Code Smells Configuration
 [smells]
 mode = "block"
@@ -44,26 +43,18 @@ threshold = 4
 enabled = true
 threshold = 5
 
-[smells.function_length]
+[smells.file_complexity]
 enabled = true
 threshold = 50
 
-[smells.file_length]
+[smells.function_complexity]
 enabled = true
-threshold = 500
+threshold = 18
 
-[smells.cognitive_complexity]
+[smells.identical_code]
 enabled = true
 threshold = 15
 
-[smells.duplicate_code]
+[smells.similar_code]
 enabled = true
-threshold = 6
-
-[smells.large_class]
-enabled = true
-threshold = 500
-
-[smells.long_parameter_list]
-enabled = true
-threshold = 2
+threshold = 15