diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dc1dac8..b1b00f7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,3 @@ -# Keeps the SHA-pinned action references in .github/workflows/ current. -# Pinning without this means the pins silently rot. version: 2 updates: - package-ecosystem: github-actions diff --git a/.github/workflows/action-tag.yml b/.github/workflows/action-tag.yml index a240234..36a17d2 100644 --- a/.github/workflows/action-tag.yml +++ b/.github/workflows/action-tag.yml @@ -30,7 +30,6 @@ on: - action.yml - scripts/render-github-action-comment.mjs -# No default permissions. Each job declares its own. permissions: {} concurrency: diff --git a/.github/workflows/react-doctor.yml b/.github/workflows/react-doctor.yml index e7d3d35..470ee4b 100644 --- a/.github/workflows/react-doctor.yml +++ b/.github/workflows/react-doctor.yml @@ -1,20 +1,12 @@ -# React Doctor — finds security, performance, correctness, accessibility, -# bundle-size, and architecture issues in React codebases. -# -# Docs: https://www.react.doctor/ci -# Source: https://github.com/millionco/react-doctor - name: React Doctor on: - # Scans the PR's changed files and posts a sticky summary comment listing only the new issues introduced relative to the merge base of the target branch. pull_request: types: - opened - synchronize - reopened - ready_for_review - # Scans `main` on every push to track the health-score trend and catch regressions that slipped past PR review. push: branches: - main @@ -25,7 +17,6 @@ permissions: issues: write statuses: write -# Cancels any in-flight scan for the same PR (or branch, on push) the moment a new commit arrives, so reviewers only ever see the latest run. concurrency: group: react-doctor-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true @@ -45,19 +36,3 @@ jobs: # doctor.config.ts — so the videos exclusion must be repeated here. with: project: web - # Advisory by default: React Doctor reports findings on every PR — a - # sticky summary comment, inline review comments, and a commit status - # with the health score — but never fails the check, so it won't red-X - # a teammate's PR on day one. When your team trusts the signal, graduate - # the gate: uncomment the block below and set blocking to "error" (fail - # on new error-severity findings) or "warning" (fail on any finding). - # Full reference: https://www.react.doctor/ci - # with: - # blocking: error # Gate level: "none" (advisory, the default) | "warning" | "error" - # scope: full # On PRs, scan the whole project instead of just changed files - # comment: false # Disable the sticky PR summary comment - # review-comments: false # Disable inline review comments on changed lines - # commit-status: false # Disable the commit status (score + counts, links to the run) - # version: "0.4.0" # Pin to a specific react-doctor version instead of "latest" - # directory: apps/web # Scan a sub-directory (default: ".") - # project: "web,admin" # In a monorepo, scan specific workspace project(s) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fbb2771..1c98e11 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,6 @@ on: branches: - main -# Each job declares exactly what it needs. permissions: {} # One release at a time; never cancel a run that may already have published. @@ -202,8 +201,8 @@ jobs: # redeploy. Kick a fresh deploy of main once the release has fully landed. - name: Trigger web deploy # !cancelled(): the changelog page only needs the npm publish, so a - # failed kit push earlier in the job must not skip this step (it did - # for 0.4.4, leaving the page stale — the exact problem #98 fixed). + # failed step earlier in the job must not skip this one once + # `published` is true. if: ${{ !cancelled() && steps.publish.outputs.published == 'true' }} env: DEPLOY_HOOK: ${{ secrets.VERCEL_DEPLOY_HOOK_URL }} diff --git a/oxfmt.config.ts b/oxfmt.config.ts index 99f0ce7..e762b36 100644 --- a/oxfmt.config.ts +++ b/oxfmt.config.ts @@ -5,7 +5,7 @@ export default defineConfig({ ...ultracite, ignorePatterns: [ ".cursor/hooks", - // Deliberately malformed inputs for the CLI's end-to-end tests. + // The CLI's end-to-end fixtures, some of them deliberately malformed. "packages/docker-doctor/test/fixtures", "apps/web/components/ui", "packages/videos/src/components", diff --git a/oxlint.config.ts b/oxlint.config.ts index e5f79c3..c9b65ad 100644 --- a/oxlint.config.ts +++ b/oxlint.config.ts @@ -14,7 +14,7 @@ export default defineConfig({ extends: [core, next, react, nextJsPlugins, antiSlop, gdp, jsPlugins], ignorePatterns: [ ".cursor/hooks", - // Deliberately malformed inputs for the CLI's end-to-end tests. + // The CLI's end-to-end fixtures, some of them deliberately malformed. "packages/docker-doctor/test/fixtures", "apps/web/components/ui", "packages/videos/src/components", diff --git a/scripts/generate-rules-doc.ts b/scripts/generate-rules-doc.ts index 4bb6d7d..a92e4b2 100644 --- a/scripts/generate-rules-doc.ts +++ b/scripts/generate-rules-doc.ts @@ -6,12 +6,10 @@ * * bun run docs:rules * - * Run by Bun (not the app's `tsc`), so importing core's raw-TS sources is - * safe here even though the web app cannot import them directly — see the - * note in `apps/web/lib/score.ts` about core's ES2018 regex named groups - * versus the web app's ES2017 target. Generation fails if a rule has no - * authored content (or content references a rule that no longer ships), so - * the pages can never drift from the rules the CLI actually runs. + * Run by Bun, which imports core's raw TypeScript sources directly. + * Generation fails if a rule has no authored content (or content references + * a rule that no longer ships), so the pages can never drift from the rules + * the CLI actually runs. */ import { mkdir, readdir, rm, writeFile } from "node:fs/promises"; import path from "node:path"; diff --git a/scripts/rule-page-content.ts b/scripts/rule-page-content.ts index 3f36a93..24874ff 100644 --- a/scripts/rule-page-content.ts +++ b/scripts/rule-page-content.ts @@ -38,7 +38,6 @@ interface RulePages { readonly [ruleKey: string]: RulePageContent; } -// Examples that more than one rule page shows. const APT_CLEAN_LAYER = "FROM debian:12-slim\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends curl \\\n && rm -rf /var/lib/apt/lists/*"; diff --git a/scripts/sync-kit-spec.ts b/scripts/sync-kit-spec.ts index d43a69b..8ea1df2 100644 --- a/scripts/sync-kit-spec.ts +++ b/scripts/sync-kit-spec.ts @@ -30,7 +30,6 @@ interface ManifestFields { version?: unknown; } -// Any JSON object can be read field by field. isKitManifest checks the fields. const isJsonObject = (value: unknown): value is ManifestFields => typeof value === "object" && value !== null;