ci: remove and correct stale comments in workflows and scripts

.github/dependabot.yml

@@ -1,5 +1,3 @@
-# Keeps the SHA-pinned action references in .github/workflows/ current.
-# Pinning without this means the pins silently rot.
 version: 2
 updates:
   - package-ecosystem: github-actions

.github/workflows/action-tag.yml

@@ -30,7 +30,6 @@ on:
       - action.yml
       - scripts/render-github-action-comment.mjs
 
-# No default permissions. Each job declares its own.
 permissions: {}
 
 concurrency:

.github/workflows/react-doctor.yml

@@ -1,20 +1,12 @@
-# React Doctor — finds security, performance, correctness, accessibility,
-# bundle-size, and architecture issues in React codebases.
-#
-# Docs: https://www.react.doctor/ci
-# Source: https://github.com/millionco/react-doctor
-
 name: React Doctor
 
 on:
-  # Scans the PR's changed files and posts a sticky summary comment listing only the new issues introduced relative to the merge base of the target branch.
   pull_request:
     types:
       - opened
       - synchronize
       - reopened
       - ready_for_review
-  # Scans `main` on every push to track the health-score trend and catch regressions that slipped past PR review.
   push:
     branches:
       - main
@@ -25,7 +17,6 @@ permissions:
   issues: write
   statuses: write
 
-# Cancels any in-flight scan for the same PR (or branch, on push) the moment a new commit arrives, so reviewers only ever see the latest run.
 concurrency:
   group: react-doctor-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -45,19 +36,3 @@ jobs:
         # doctor.config.ts — so the videos exclusion must be repeated here.
         with:
           project: web
-        # Advisory by default: React Doctor reports findings on every PR — a
-        # sticky summary comment, inline review comments, and a commit status
-        # with the health score — but never fails the check, so it won't red-X
-        # a teammate's PR on day one. When your team trusts the signal, graduate
-        # the gate: uncomment the block below and set blocking to "error" (fail
-        # on new error-severity findings) or "warning" (fail on any finding).
-        # Full reference: https://www.react.doctor/ci
-        # with:
-        #   blocking: error          # Gate level: "none" (advisory, the default) | "warning" | "error"
-        #   scope: full              # On PRs, scan the whole project instead of just changed files
-        #   comment: false           # Disable the sticky PR summary comment
-        #   review-comments: false   # Disable inline review comments on changed lines
-        #   commit-status: false     # Disable the commit status (score + counts, links to the run)
-        #   version: "0.4.0"         # Pin to a specific react-doctor version instead of "latest"
-        #   directory: apps/web      # Scan a sub-directory (default: ".")
-        #   project: "web,admin"     # In a monorepo, scan specific workspace project(s)

.github/workflows/release.yml

@@ -17,7 +17,6 @@ on:
     branches:
       - main
 
-# Each job declares exactly what it needs.
 permissions: {}
 
 # One release at a time; never cancel a run that may already have published.
@@ -202,8 +201,8 @@ jobs:
       # redeploy. Kick a fresh deploy of main once the release has fully landed.
       - name: Trigger web deploy
         # !cancelled(): the changelog page only needs the npm publish, so a
-        # failed kit push earlier in the job must not skip this step (it did
-        # for 0.4.4, leaving the page stale — the exact problem #98 fixed).
+        # failed step earlier in the job must not skip this one once
+        # `published` is true.
         if: ${{ !cancelled() && steps.publish.outputs.published == 'true' }}
         env:
           DEPLOY_HOOK: ${{ secrets.VERCEL_DEPLOY_HOOK_URL }}

oxfmt.config.ts

@@ -5,7 +5,7 @@ export default defineConfig({
   ...ultracite,
   ignorePatterns: [
     ".cursor/hooks",
-    // Deliberately malformed inputs for the CLI's end-to-end tests.
+    // The CLI's end-to-end fixtures, some of them deliberately malformed.
     "packages/docker-doctor/test/fixtures",
     "apps/web/components/ui",
     "packages/videos/src/components",

oxlint.config.ts

@@ -14,7 +14,7 @@ export default defineConfig({
   extends: [core, next, react, nextJsPlugins, antiSlop, gdp, jsPlugins],
   ignorePatterns: [
     ".cursor/hooks",
-    // Deliberately malformed inputs for the CLI's end-to-end tests.
+    // The CLI's end-to-end fixtures, some of them deliberately malformed.
     "packages/docker-doctor/test/fixtures",
     "apps/web/components/ui",
     "packages/videos/src/components",

scripts/generate-rules-doc.ts

@@ -6,12 +6,10 @@
  *
  *   bun run docs:rules
  *
- * Run by Bun (not the app's `tsc`), so importing core's raw-TS sources is
- * safe here even though the web app cannot import them directly — see the
- * note in `apps/web/lib/score.ts` about core's ES2018 regex named groups
- * versus the web app's ES2017 target. Generation fails if a rule has no
- * authored content (or content references a rule that no longer ships), so
- * the pages can never drift from the rules the CLI actually runs.
+ * Run by Bun, which imports core's raw TypeScript sources directly.
+ * Generation fails if a rule has no authored content (or content references
+ * a rule that no longer ships), so the pages can never drift from the rules
+ * the CLI actually runs.
  */
 import { mkdir, readdir, rm, writeFile } from "node:fs/promises";
 import path from "node:path";

scripts/rule-page-content.ts

@@ -38,7 +38,6 @@ interface RulePages {
   readonly [ruleKey: string]: RulePageContent;
 }
 
-// Examples that more than one rule page shows.
 const APT_CLEAN_LAYER =
   "FROM debian:12-slim\nRUN apt-get update \\\n  && apt-get install -y --no-install-recommends curl \\\n  && rm -rf /var/lib/apt/lists/*";
 

scripts/sync-kit-spec.ts

@@ -30,7 +30,6 @@ interface ManifestFields {
   version?: unknown;
 }
 
-// Any JSON object can be read field by field. isKitManifest checks the fields.
 const isJsonObject = (value: unknown): value is ManifestFields =>
   typeof value === "object" && value !== null;