Skip to content

chore/merge next into main - #185

Merged
taraxvoid merged 10 commits into
mainfrom
chore/merge_next_into_main
Oct 16, 2026
Merged

taraxvoid merged 10 commits into
mainfrom
chore/merge_next_into_main

Conversation

@taraxvoid

Copy link
Copy Markdown
Owner

github-actions Bot and others added 10 commits October 12, 2026 05:28
chore: back-merge v0.13.0 into next
## What and why

actionlint is deprecated (mise now warns on it) in favour of
[jactionlint](https://github.com/jdx/jactionlint), an actively
maintained fork with upstream fixes merged.

- `ci.yml`, `site-ci.yml` and the justfile pin jactionlint 2.1.0 and
verify the release attestation wherever it's downloaded (site-ci
previously piped actionlint's download script from curl).
- **Consumers:** site-ci runs `--profile correctness`, which is
actionlint's rule set, unless the caller's `.github/jactionlint.yaml` /
`actionlint.yaml` sets `profile:`. That way this release can't fail
caller CI on the default profile's new rules, and a repo can opt in when
it's ready.
- voidflow sets `profile: correctness` in `.github/jactionlint.yaml` for
now. The default profile reports 9 findings, tracked in a follow-up.
- `just lint-workflows` checks `jactionlint --version` instead of
`command -v`, because a mise shim with no version set is on PATH but
fails.

Verified locally: `just lint-workflows` (download path included), `just
lint-actions`, `just security`.

Closes #173

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Closes #155.

Makes voidflow the default kit for any @taraxvoid bun repo, not only
Astro sites.

## Changes

- **`lefthook/base.yml`** (breaking): the hook set moves from
`lefthook/site.yml` to `lefthook/base.yml`. Before the `test:unit` and
`test:push` steps it runs `unset $(git rev-parse --local-env-vars)`, so
tests that spawn git in a temp repo no longer act on the hooked repo.
Tests run the real hook snippets against a stub to check this.
- **`lefthook/site.yml` stub**: Renovate bumps only `ref:`, and lefthook
skips a missing remote config without any warning. A plain rename would
therefore turn every consumer's hooks off silently. `site.yml` is now a
stub whose `pre-commit` and `pre-push` fail with the one-line fix.
- **mise**: a `mise.toml` for contributor tools, plus a `prepare` script
that tolerates a missing `lefthook` binary. The README setup becomes
`mise install && bun install`, and the consumer docs get a starter
`mise.toml`. The package description and keywords now cover tools.
- **`tool-ci.yml`**: a reusable validation workflow for bun tools.
- Steps: gitleaks, the shared install script, `mise-action` when the
repo has a `mise.toml`, then
`lint`/`check`/`build`/`test`/`check:licenses` for whichever scripts
`package.json` defines. actionlint and zizmor run when workflows change.
  - The job reports `validate / Validate`.
- Parity tests keep the steps it shares identical to `site-ci.yml` and
`actions/bun-install`.
- **Rulesets**: a `tool()` helper (main only, no Netlify, CODEOWNERS,
linear history, requires `validate / Validate`). `SITE_CHECK` is renamed
`VALIDATE_CHECK`.

## Migration

Consumers change `configs: [lefthook/site.yml]` to `lefthook/base.yml`
when they bump `ref`. Until they do, commits and pushes fail with that
instruction.

## Notes

- On free personal plan the rulesets API returns 403 for private repos,
which aborts the whole `apply-rulesets` run.
- `bun scripts/apply-rulesets.ts --check` reports the fleet in sync. An
earlier run listed 5 differences, but none was drift. They were retired
`next (staging)`/`live (prod)` rulesets on queeromaha, soundry and
synthomaha, waiting for `--prune`. Those rulesets have now been pruned,
and the stale `next`/`live` branches on soundry and synthomaha (0
commits ahead of main, no open PRs) have been deleted. That cleanup was
done out of band; this branch does not change it.

## Verification

- `bun test`: 148 pass, 0 fail.
- `just validate`: actionlint, check-jsonschema, shellcheck, gitleaks
and zizmor all clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…iome (#183)

Closes #182

- `biome/base.json`: the house style five sites already share (4-space,
LF, width 80, single quotes, semicolons as needed, trailing commas,
`recommended` preset, organize imports, CSS lint off, HTML formatter
settings, git ignore file, `.astro` unused-import override). No ignore
lists; those stay per site.
- Exported as `@taraxvoid/voidflow/biome` and added to `files`, so a
site writes `"extends": ["@taraxvoid/voidflow/biome"]`.
- Biome 1.x warning (never fails) in the `lefthook/site.yml` pre-commit
hook and a `Check Biome version` step in `site-ci.yml` before `Lint
Code`.
- README section on using it.

## Testing

`test/biome-base.test.ts` builds a throwaway site that extends the
package by name and runs Biome 2.5.14 (new exact devDependency) on it:
- the base resolves through the package export
- house style is enforced (semicolons, double quotes fail) and the
recommended preset is on
- the `.astro` override matches files in the extending site (with a
control showing recommended flags the same file without the base)
- a site setting overrides the base

It also runs the hook and CI snippets against fake installs of Biome
1.9.4, 2.5.14 and none.

`bun test`: 125 pass, 1 fail. The failure is `lefthook/site.yml > is a
valid lefthook config`, which fails locally because `lefthook` on PATH
is a mise shim with no version set (`Bun.which` finds the shim). `mise
exec lefthook@2.2.1 -- lefthook validate` on the changed config prints
"All good". `just lint-workflows lint-shell lint-actions` pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
#157 (e775c8b) committed mise state from a run with HOME at the repo
root: `.cache/mise/`, `.local/share/mise/` (including lefthook binaries)
and `.local/state/mise/`, plus a stray file `f` containing `y`.

This removes them and adds `/.cache/` and `/.local/` to `.gitignore` so
they don't come back. `mise.toml` stays.

Refs #157

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run from a git hook in a worktree, GIT_DIR pointed the test's git calls at
the real repo, moving local main and committing fixtures there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@taraxvoid
taraxvoid merged commit 25b7b53 into main Oct 16, 2026
2 checks passed
@taraxvoid
taraxvoid deleted the chore/merge_next_into_main branch October 16, 2026 04:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant