From 7a71c401f35d6f50770fd1f9f5f68ac7ec7d83ce Mon Sep 17 00:00:00 2001 From: PunGrumpy <108584943+PunGrumpy@users.noreply.github.com> Date: Fri, 23 Oct 2026 09:02:27 +0700 Subject: [PATCH 1/3] ci: remove comments that repeat the workflows react-doctor.yml still carried the vendor's scaffold: a banner, comments that restate the triggers and the concurrency group, and a commented-out `with:` block with setup advice. dependabot.yml said the action references are SHA-pinned, but 29 of the 43 in .github/workflows pin a tag. release.yml and action-tag.yml each restated `permissions: {}` in prose. --- .github/dependabot.yml | 2 -- .github/workflows/action-tag.yml | 1 - .github/workflows/react-doctor.yml | 25 ------------------------- .github/workflows/release.yml | 1 - 4 files changed, 29 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dc1dac89..b1b00f76 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,3 @@ -# Keeps the SHA-pinned action references in .github/workflows/ current. -# Pinning without this means the pins silently rot. version: 2 updates: - package-ecosystem: github-actions diff --git a/.github/workflows/action-tag.yml b/.github/workflows/action-tag.yml index a240234c..36a17d28 100644 --- a/.github/workflows/action-tag.yml +++ b/.github/workflows/action-tag.yml @@ -30,7 +30,6 @@ on: - action.yml - scripts/render-github-action-comment.mjs -# No default permissions. Each job declares its own. permissions: {} concurrency: diff --git a/.github/workflows/react-doctor.yml b/.github/workflows/react-doctor.yml index e7d3d350..470ee4b2 100644 --- a/.github/workflows/react-doctor.yml +++ b/.github/workflows/react-doctor.yml @@ -1,20 +1,12 @@ -# React Doctor — finds security, performance, correctness, accessibility, -# bundle-size, and architecture issues in React codebases. -# -# Docs: https://www.react.doctor/ci -# Source: https://github.com/millionco/react-doctor - name: React Doctor on: - # Scans the PR's changed files and posts a sticky summary comment listing only the new issues introduced relative to the merge base of the target branch. pull_request: types: - opened - synchronize - reopened - ready_for_review - # Scans `main` on every push to track the health-score trend and catch regressions that slipped past PR review. push: branches: - main @@ -25,7 +17,6 @@ permissions: issues: write statuses: write -# Cancels any in-flight scan for the same PR (or branch, on push) the moment a new commit arrives, so reviewers only ever see the latest run. concurrency: group: react-doctor-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true @@ -45,19 +36,3 @@ jobs: # doctor.config.ts — so the videos exclusion must be repeated here. with: project: web - # Advisory by default: React Doctor reports findings on every PR — a - # sticky summary comment, inline review comments, and a commit status - # with the health score — but never fails the check, so it won't red-X - # a teammate's PR on day one. When your team trusts the signal, graduate - # the gate: uncomment the block below and set blocking to "error" (fail - # on new error-severity findings) or "warning" (fail on any finding). - # Full reference: https://www.react.doctor/ci - # with: - # blocking: error # Gate level: "none" (advisory, the default) | "warning" | "error" - # scope: full # On PRs, scan the whole project instead of just changed files - # comment: false # Disable the sticky PR summary comment - # review-comments: false # Disable inline review comments on changed lines - # commit-status: false # Disable the commit status (score + counts, links to the run) - # version: "0.4.0" # Pin to a specific react-doctor version instead of "latest" - # directory: apps/web # Scan a sub-directory (default: ".") - # project: "web,admin" # In a monorepo, scan specific workspace project(s) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fbb2771c..16b87751 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,6 @@ on: branches: - main -# Each job declares exactly what it needs. permissions: {} # One release at a time; never cancel a run that may already have published. From 237bd8ddfb5d0fb8611495996276f1ff47f54b03 Mon Sep 17 00:00:00 2001 From: PunGrumpy <108584943+PunGrumpy@users.noreply.github.com> Date: Fri, 23 Oct 2026 09:02:40 +0700 Subject: [PATCH 2/3] refactor(scripts): remove comments that repeat the code sync-kit-spec.ts explained isJsonObject in words its name and the next function already say. rule-page-content.ts labeled its shared examples the same way. --- scripts/rule-page-content.ts | 1 - scripts/sync-kit-spec.ts | 1 - 2 files changed, 2 deletions(-) diff --git a/scripts/rule-page-content.ts b/scripts/rule-page-content.ts index 3f36a939..24874ffd 100644 --- a/scripts/rule-page-content.ts +++ b/scripts/rule-page-content.ts @@ -38,7 +38,6 @@ interface RulePages { readonly [ruleKey: string]: RulePageContent; } -// Examples that more than one rule page shows. const APT_CLEAN_LAYER = "FROM debian:12-slim\nRUN apt-get update \\\n && apt-get install -y --no-install-recommends curl \\\n && rm -rf /var/lib/apt/lists/*"; diff --git a/scripts/sync-kit-spec.ts b/scripts/sync-kit-spec.ts index d43a69b3..8ea1df24 100644 --- a/scripts/sync-kit-spec.ts +++ b/scripts/sync-kit-spec.ts @@ -30,7 +30,6 @@ interface ManifestFields { version?: unknown; } -// Any JSON object can be read field by field. isKitManifest checks the fields. const isJsonObject = (value: unknown): value is ManifestFields => typeof value === "object" && value !== null; From f27677a5a771842da85e7b0e7883ec835c0f0a32 Mon Sep 17 00:00:00 2001 From: PunGrumpy <108584943+PunGrumpy@users.noreply.github.com> Date: Fri, 23 Oct 2026 09:02:49 +0700 Subject: [PATCH 3/3] chore: correct comments that no longer match the code - oxlint.config.ts and oxfmt.config.ts called the CLI test fixtures deliberately malformed. Most of them are valid projects, and only some are malformed. - release.yml explained `!cancelled()` with a kit push earlier in the job. The publish job has had no kit push since kit-push.yml took it over. - generate-rules-doc.ts pointed at a note in apps/web/lib/score.ts about regex named groups and an ES2017 target. That note explains why client components cannot import core's barrel, which has nothing to do with this script. --- .github/workflows/release.yml | 4 ++-- oxfmt.config.ts | 2 +- oxlint.config.ts | 2 +- scripts/generate-rules-doc.ts | 10 ++++------ 4 files changed, 8 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 16b87751..1c98e113 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -201,8 +201,8 @@ jobs: # redeploy. Kick a fresh deploy of main once the release has fully landed. - name: Trigger web deploy # !cancelled(): the changelog page only needs the npm publish, so a - # failed kit push earlier in the job must not skip this step (it did - # for 0.4.4, leaving the page stale — the exact problem #98 fixed). + # failed step earlier in the job must not skip this one once + # `published` is true. if: ${{ !cancelled() && steps.publish.outputs.published == 'true' }} env: DEPLOY_HOOK: ${{ secrets.VERCEL_DEPLOY_HOOK_URL }} diff --git a/oxfmt.config.ts b/oxfmt.config.ts index 99f0ce78..e762b361 100644 --- a/oxfmt.config.ts +++ b/oxfmt.config.ts @@ -5,7 +5,7 @@ export default defineConfig({ ...ultracite, ignorePatterns: [ ".cursor/hooks", - // Deliberately malformed inputs for the CLI's end-to-end tests. + // The CLI's end-to-end fixtures, some of them deliberately malformed. "packages/docker-doctor/test/fixtures", "apps/web/components/ui", "packages/videos/src/components", diff --git a/oxlint.config.ts b/oxlint.config.ts index e5f79c3f..c9b65ad8 100644 --- a/oxlint.config.ts +++ b/oxlint.config.ts @@ -14,7 +14,7 @@ export default defineConfig({ extends: [core, next, react, nextJsPlugins, antiSlop, gdp, jsPlugins], ignorePatterns: [ ".cursor/hooks", - // Deliberately malformed inputs for the CLI's end-to-end tests. + // The CLI's end-to-end fixtures, some of them deliberately malformed. "packages/docker-doctor/test/fixtures", "apps/web/components/ui", "packages/videos/src/components", diff --git a/scripts/generate-rules-doc.ts b/scripts/generate-rules-doc.ts index 4bb6d7d9..a92e4b2b 100644 --- a/scripts/generate-rules-doc.ts +++ b/scripts/generate-rules-doc.ts @@ -6,12 +6,10 @@ * * bun run docs:rules * - * Run by Bun (not the app's `tsc`), so importing core's raw-TS sources is - * safe here even though the web app cannot import them directly — see the - * note in `apps/web/lib/score.ts` about core's ES2018 regex named groups - * versus the web app's ES2017 target. Generation fails if a rule has no - * authored content (or content references a rule that no longer ships), so - * the pages can never drift from the rules the CLI actually runs. + * Run by Bun, which imports core's raw TypeScript sources directly. + * Generation fails if a rule has no authored content (or content references + * a rule that no longer ships), so the pages can never drift from the rules + * the CLI actually runs. */ import { mkdir, readdir, rm, writeFile } from "node:fs/promises"; import path from "node:path";