This repository was archived by the owner on Oct 26, 2026. It is now read-only.
Repository navigation
chore: parse rules with oxc-parser and drop TypeScript compiler installs - #43
Open
jan-kubica wants to merge 4 commits into
Open
jan-kubica wants to merge 4 commits into
jan-kubica wants to merge 4 commits into
Conversation
The JavaScript/TypeScript AST rule now parses with oxc-parser 0.155.0 instead of the TypeScript compiler API. The ESTree walker reproduces the previous traversal, including destructuring-assignment defaults, optional chains, JSX names and private member names, so findings are unchanged on valid input. Files with syntax errors now produce a JSA10 scan-integrity finding instead of a partial scan. Declarations build with tsdown's oxc generator, so exported values carry explicit types and the catalog uses literal category and severity values. The typecheck parity script, its CI step and the native TypeScript 7 alias are removed. The rules package no longer depends on typescript; the root keeps typescript 7.0.2 only because stll-toolchain-check resolves its tsc to list type-aware lint projects.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 811d2ae967
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A script with a syntax error produced only a medium JSA10 finding, which the standard policy does not block, and its AST rules never ran. JSA10 is now high severity, so an unanalyzable script fails the standard policy, and the AST rules still run on the program oxc-parser recovers around the error.
The toolchain check reads tsconfig projects without a TypeScript install, so the root typescript devDependency goes, and the policy test and docs now require that no manifest declares a TypeScript compiler. Bump @stll/typescript-config to 0.10.0, @stll/oxlint-plugin to 0.6.3 and lefthook to 2.2.2, regenerate the cloud setup and Dependabot config, and move the upload-artifact pin to the shared version.
The shared TypeScript config now reports unreachable code, which flagged the exhaustiveness checks after fully handled switches. Each check moves into the switch default clause, so behavior is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
One type checker (
bun check, already used by every workspace) and no TypeScript compiler in the published packages.skillguard.js-ts-astnow parses withoxc-parser0.155.0 instead of the TypeScript compiler API. The ESTree walker reproduces the previous traversal: destructuring-assignment defaults count as assignments, optional chains unwrap, JSX names and private member names resolve as before.@stll/skillguard-rulesno longer depends ontypescript.JSA10scan-integrity finding (Medium) instead of a partial scan of whatever the tolerant parser recovered. The catalog documents the new pattern.--dts.generator oxc, so no compiler is needed for.d.ts. That generator needs explicit export types:scanWithRecommendedRulesis annotated, catalog entries use literal category and severity values, andRULE_CATALOG_BY_PATTERNis typedReadonlyMap<RulePatternId, RuleCatalogEntry>, which also checks each entry's shape.check:typecheck-parityscript, its CI step (and the change detector that gated it), the@typescript/nativealias and the roottypescriptdevDependency are removed:@stll/oxlint-config2.0.0 reads the tsconfig projects forstll-toolchain-checkwithout a TypeScript install, so notypescriptAllowlistentry is needed. The toolchain policy test now requires that no manifest declares a TypeScript compiler.@stll/oxlint-config2.0.0,@stll/typescript-config0.10.0,@stll/oxlint-plugin0.6.3 andlefthook2.2.2; the cloud setup and.github/dependabot.ymlare regenerated and theactions/upload-artifactpin moves to the shared version. The shared TypeScript config now reports unreachable code, so the exhaustiveness checks after fully handled switches move into each switch'sdefaultclause (no behavior change).check:toolchainfindings are the Bun 1.4.4 pins and thebun fmtformatter policy, which chore: adopt Bun 1.4.4 and bun fmt #41 adopts. After chore: adopt Bun 1.4.4 and bun fmt #41 lands, this branch takes main and the check passes.Parity
The rule was run before and after the change over 30,493 real JavaScript/TypeScript files (this repository, a large TypeScript monorepo and its
node_modules). Both runs produced 1,132 findings in 564 files, with every finding identical. The only difference was in the editedindex.tsitself, where line numbers shifted. No corpus file had a syntax error under oxc-parser. A set of edge-case files (escaped identifiers, optional chains, destructuring defaults, JSX member tags, private names, script-modewith/octal/HTML comments, decorators, enums) also matched finding for finding. CLI scans of every fixture with--preset paranoid --format jsonare byte-identical. Scanning is faster: the rule over the full corpus no longer loads the TypeScript compiler.Checks
check:toolchain,check:lockfile-versions,lint:ws,typecheck,lint,format:check,test,knip,build,intent:validate,pack:verifyandscripts/tooling-adoption.test.tspass. New tests cover the ESTree shapes above and theJSA10finding.