feat(SIG-107): add TypeScript compiler evidence

[damartinezjulio]

What

• Add a default-on TypeScript compiler lane that runs tsc --noEmit when TS configs are present and emits tsc.sarif.
• Install TypeScript from a pinned npm tarball, verify its SHA-512 integrity, and install it with lifecycle scripts disabled.
• Convert TypeScript diagnostics into Sigilix SARIF metadata, filtering only bare external dependency/declaration noise while preserving path-like and scoped unresolved imports for recall.
• Wire tsc into the static tool manifest, SARIF contract tests, CI helper tests, and README catalog.

Why

This adds type-aware TypeScript signal that ESLint/Oxlint/Biome do not fully cover: assignment incompatibilities, strict project type errors, and config-scoped compiler diagnostics. The lane self-skips when no TS config exists and keeps caller CI non-fatal by converting diagnostics to SARIF.

Verification

• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/tsc_workflow_test.py — 5 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/sigilix_sarif_test.py — 64 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/eslint_ts_workflow_test.py — 5 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/pylint_workflow_test.py — 5 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/knip_workflow_test.py — 4 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/biome_workflow_test.py — 6 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/docs_config_tools_test.py — 7 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/oxlint_workflow_test.py — 4 tests OK
• PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/ast_grep_workflow_test.py — 4 tests OK
• python3 -m py_compile .github/scripts/*.py
• bash -n .github/scripts/*.sh
• git diff --check
• repository line cap check, largest touched file remains .github/scripts/sigilix_sarif_test.py at 999 lines
• actionlint 1.7.12 on scan.yml and ci.yml
• ShellCheck 0.11.0 on run_tsc.sh
• real TypeScript smoke: verified TypeScript tarball, retained tsc/TS2322, filtered bare external TS2307

Reviewer sign-off: final DeepSeek code-reviewer verdict was SHIP; security reviewer found no material new unsafe execution/data-exfiltration path compared with existing Node-based lanes.

[sigilix]

Sigilix Overview

Effort: 4/5 (large)

Quality gates

• ✅ PR title follows convention
• ✅ PR description is complete
• ℹ️ PR is linked to an issue — No Closes #N / Closes SIG-N keyword found in PR body or commit messages.

Summary — latest push

Adds a default-on TypeScript compiler lane that installs a pinned TypeScript tarball with SHA-512 integrity verification and converts tsc --noEmit diagnostics into Sigilix SARIF, filtering bare external dependency/declaration noise while preserving path-like and scoped unresolved imports. The specialist review flagged a logic flaw in the scoped-package filter that will misclassify @types scoped subpath imports (e.g., @types/react-dom/v18) as external noise, and a security concern around the npm pack output parsing being vulnerable to injection. Both issues require targeted fixes before merge.

Important files

File	Score	Notes	Next step
.github/scripts/run_tsc.sh	5/5	Orchestrates TypeScript config discovery, tarball download, integrity verification, and tsc execution, delegating SARIF conversion to Python.	Harden the tsc_package assignment by piping npm pack output through tail -n 1 directly into a variable and validating it matches a strict filename regex (e.g., ^typescript-[0-9]+.[0-9]+.[0-9]+.tgz$) to prevent command injection from a malicious registry response.
.github/scripts/tsc_to_sarif.py	5/5	Parses tsc diagnostic output and converts it to SARIF, applying heuristics to drop external dependency noise while preserving path-like imports.	Fix the _looks_like_external_package logic so that @types scoped subpath imports like @types/react-dom/v18 are correctly classified as external noise by checking len(parts) > 2 instead of specifier.count('/') == 1.
.github/scripts/tsc_workflow_test.py	4/5	Integration and unit tests validating the TSC workflow, SARIF conversion, and dependency noise filtering logic.	Add explicit test cases for @types scoped subpath imports (e.g., @types/react-dom/v18) and bare @types packages to assert they are correctly filtered, and add a test ensuring npm pack output with unexpected characters is handled safely.
.github/workflows/scan.yml	2/5	Wires the tsc input, integrity pin, and runner step into the scan workflow.	Confirm the pinned integrity hash will be rotated via an automated process when TYPESCRIPT_VERSION bumps.
.github/scripts/sigilix_sarif_contract.py	1/5	Registers tsc in the allowed tool IDs and display names.	Verify the display name matches the README catalog entry for consistency.

Confidence: 2/5

The scoped-package filtering logic incorrectly retains @types subpath imports as signal, and the npm pack output parsing is vulnerable to injection from a compromised registry.

• Fix _looks_like_external_package in tsc_to_sarif.py so @types/react-dom/v18 is correctly identified as external noise (currently falls through to return '/' not in specifier which evaluates to False).
• Harden run_tsc.sh line 83 against command injection by validating the npm pack output matches an expected filename pattern before using it in subsequent file paths.
• Verify the tsc_exit check on line 104 correctly handles exit code 1 (diagnostics present) vs exit code 2 (catastrophic failure) to ensure real type errors aren't silently dropped.
• Confirm the --ignore-scripts flag on line 91 is consistently applied to prevent lifecycle script execution during the npm install phase.

Suggested labels: bug security

[coderabbitai]

Warning

Review limit reached

@damartinezjulio, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 2 hours, 54 minutes, and 25 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9bfd6d92-0f4a-423e-a3a8-ca1b295799a8

📥 Commits

Reviewing files that changed from the base of the PR and between 3bc24b1 and e558787.

📒 Files selected for processing (9)

• .github/config/tool-manifest.json
• .github/scripts/run_tsc.sh
• .github/scripts/sigilix_sarif_contract.py
• .github/scripts/sigilix_sarif_test.py
• .github/scripts/tsc_to_sarif.py
• .github/scripts/tsc_workflow_test.py
• .github/workflows/ci.yml
• .github/workflows/scan.yml
• README.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sig-107-tsc-types

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sigilix]

2 findings posted inline · coverage: logic · security · performance · tests

2 findings · 2 inline · Proof: 2 grounded

The TypeScript compiler lane is well-implemented with strong supply-chain integrity and comprehensive testing. A logic bug in the dependency-noise filter may cause scoped npm packages to be misclassified as internal imports, leading to false positive diagnostics in the SARIF output.

_{Dismiss: @sigilix dismiss <reason> in thread (not-a-bug|bad-anchor|already-covered|too-minor|wrong-context) · Re-run: /sigilix review · Review #1 · a091afa}

[sigilix]

1 high-severity finding + 1 lower-severity inline · since last review: +2 new · 2 carried-over · coverage: logic · security · performance · tests

2 findings · 2 inline · Proof: 2 grounded

The PR introduces a TypeScript compiler lane that converts tsc --noEmit diagnostics to SARIF. The implementation follows established security and runner patterns, featuring pinned integrity checks and a comprehensive test suite.

Severity	Location	Issue
High (4)	.github/scripts/tsc_to_sarif.py:75-82	logic: _looks_like_external_package drops scoped-package unresolved imports (e.g. @scope/pkg) when the specifier contains a slash

_{Dismiss: @sigilix dismiss <reason> in thread (not-a-bug|bad-anchor|already-covered|too-minor|wrong-context) · Re-run: /sigilix review · Review #2 · a091afa}

[sigilix]

3 findings posted inline · since last review: +3 new · 2 likely-fixed · coverage: logic · security · performance · tests

3 findings · 3 inline · Proof: 3 grounded

The TypeScript compiler lane is well-implemented with strong integrity checks and comprehensive testing. However, a logic error in the SARIF converter causes certain relevant path-like imports in scoped packages to be incorrectly filtered as noise.

_{Dismiss: @sigilix dismiss <reason> in thread (not-a-bug|bad-anchor|already-covered|too-minor|wrong-context) · Re-run: /sigilix review · Review #3 · 2931177}

[sigilix]

2 findings posted inline · since last review: +2 new · 3 likely-fixed · coverage: logic · security · performance · tests

2 findings · 2 inline · Proof: 2 grounded

The TypeScript compiler lane is well-implemented with strong supply-chain controls and comprehensive tests, though the unresolved-import heuristic incorrectly filters out scoped package subpaths.

_{Dismiss: @sigilix dismiss <reason> in thread (not-a-bug|bad-anchor|already-covered|too-minor|wrong-context) · Re-run: /sigilix review · Review #4 · e558787}