chore(governance): seed lint/test toolchain configs - #236
Merged
Conversation
The four lint/test toolchain files split out of the org auto-seed PR (#233), which the PR-size gate blocked at 1213 reviewable added lines (limit 1000). This sibling carries the toolchain half; #233 keeps the governance, template, and community files. Seeded here, content identical to the seed except the security hardening already applied on the #233 branch: - biome.json + .biomeignore — Biome as the single JS/TS/JSON formatter and linter owner (biome_default workspace class) - .vscode/extensions.json — recommends biome + ruff; unrecommends eslint + prettier so no second formatter owner appears (tracked with an explicit add -f, matching the seed: the repo .gitignore excludes .vscode/ but the org pack intentionally ships this one file) - .github/workflows/l9-lint-test-node.yml — org Node lint/test workflow, hardened: installs require a lockfile and run with --ignore-scripts, and the tsc step uses `npx --no-install` so only the lockfile-resolved compiler can run (Sonar S6505/S8543, Scorecard Pinned-Dependencies). Both Node jobs skip on this Python-only repo via the detect-node guard.
|
📋 Best Practices for Large Changes
✅ This PR passes the blocking limit but is larger than recommended. |
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The org auto-seed PR #233 is blocked by the PR-size gate: 1213 reviewable added
lines against a 1000-line blocking limit (
Enforce PR Policies❌). The gate'srequired action is to split.
Fix
This sibling PR carries the lint/test toolchain half of the seed, split out of
#233 (base:
main, disjoint file set — no overlap with what remains there):biome.json+.biomeignore— Biome as the single JS/TS/JSON formatter andlinter owner (
biome_defaultworkspace class).vscode/extensions.json— recommends biome + ruff; unrecommends eslint +prettier so no second formatter owner appears (added with an explicit
add -f, matching the seed's intent: repo.gitignoreexcludes.vscode/but the org pack ships this one file)
.github/workflows/l9-lint-test-node.yml— org Node lint/test workflow,hardened relative to the raw seed to clear the Sonar/Scorecard findings
that were red on chore(governance): auto-seed org templates from Quantum-L9/.github #233:
npm install/pnpm install/yarn installfallback) — Sonar S8543, ScorecardPinned-Dependencies
--ignore-scripts— Sonar S6505; a consumer whosedependencies genuinely need install-time build scripts relaxes this
per-repo, deliberately
npx --no-installso only the lockfile-resolved localcompiler can run — Sonar S6505/S8543
Both Node jobs skip on this Python-only repo via the
detect-nodeguard, sothis PR changes no CI behavior here today; the hardened defaults bind future
Node consumers.
Risk
Low — additive, four files, no runtime code. Rollback: revert this PR.
Relationship to #233
#233 keeps the governance, template, and community files (~838 added lines,
now under the gate) with its own fixes pushed on the same branch:
CODE_OF_CONDUCT whitespace (pre-commit),
governance.ymltop-levelpermissions + SHA-pinned reusable-workflow callees (Scorecard, Sonar S7637;
tag SHA verified against the file's own preflight before pinning).
Neither PR is to be merged by the remediating agent; both are left green and
merge-ready for review.
Generated by Claude Code