@davidvornholt/standards 0.29.0 → 0.29.2

package/README.md

@@ -97,14 +97,14 @@ bun standards structure --profile source
 
 `doctor` checks project-owned integration points such as `biome.jsonc`, `AGENTS.local.md`, package scripts, sync policy, settings overlays, and Dependabot inputs.
 
-`structure` checks the exact Bun declaration, root and workspace scripts, internal dependency versions, package exports, TypeScript inheritance, accessibility wiring, and CI secret structure. The `source` profile records the few intentional differences in this repository itself.
+`structure` checks the exact Bun declaration, root and workspace scripts, the root lint tasks in `turbo.json`, internal dependency versions, package exports, TypeScript inheritance, accessibility wiring, and CI secret structure. The `source` profile records the few intentional differences in this repository itself.
 
 Starting with 0.29.0, Biome runs once from the repository root instead of once per workspace. The root `package.json` must declare `lint` running `biome check --error-on-warnings .` and `lint:fix` running `biome check --write --error-on-warnings .`, and any workspace that declares `lint` or `lint:fix` fails. To upgrade an existing repository:
 
-1. Install the new CLI with `bun add --dev --exact @davidvornholt/standards@0.29.0`.
+1. Install the new CLI with `bun add --dev --exact @davidvornholt/standards@0.29.2`.
 2. Run `bun standards sync` so the canonical `packages/typescript-config` and `packages/a11y-testing` drop their lint scripts. A repository that pins `ref` in `sync-standards.local.json` first moves it to `v0.29.0` or later.
 3. Add the root `lint` and `lint:fix` scripts and remove both scripts from every workspace `package.json`.
-4. In `turbo.json`, replace the `lint` and `lint:fix` tasks with `//#lint` (`"outputs": []`) and `//#lint:fix` (`"cache": false`, `"outputs": []`), and delete any `<package>#lint` overrides. Keep the default inputs for `//#lint`.
+4. In `turbo.json`, replace the `lint` and `lint:fix` tasks with `//#lint` (`"outputs": []`) and `//#lint:fix` (`"cache": false`, `"outputs": []`), and delete any `<package>#lint` overrides. Keep the default inputs for `//#lint`. Starting with 0.29.1, `structure` fails until this step is done: Turbo runs the root lint scripts only through the `//#` tasks, so a leftover `lint` task makes `turbo run lint` pass without running Biome.
 5. Run `bun run lint:fix` and fix anything it still reports. The root run also checks root files that per-workspace runs never covered.
 
 ## dependabot

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.29.0",
+  "version": "0.29.2",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -173,6 +173,7 @@
     "src/structure-script.ts",
     "src/structure-secrets.ts",
     "src/structure-sops-envelope.ts",
+    "src/structure-turbo.ts",
     "src/structure-workspace.ts",
     "src/sync-policy.ts",
     "src/yaml-emit.ts",

package/src/cli.ts

@@ -1326,9 +1326,9 @@ const parseArgs = (argv: ReadonlyArray<string>): CliOptions => {
   };
 };
 
-// Canonical monorepo structure gate: workspace and root script shapes,
-// internal versioning, `exports`, tsconfig inheritance, a11y wiring,
-// and the undecrypted CI secrets contract
+// Canonical monorepo structure gate: workspace and root script shapes, the
+// root lint tasks in turbo.json, internal versioning, `exports`, tsconfig
+// inheritance, a11y wiring, and the undecrypted CI secrets contract
 // (SOPS shape mirroring plus the keys the synced workflows require).
 // The `source` profile instead pins the standards template repository's own
 // deliberate exceptions to the consumer contract.

package/src/creds-login-github-manifest.ts

@@ -42,9 +42,7 @@ export const resolveGithubAppName = (
 // workflow actually uses today; widening it is a deliberate edit here plus a
 // settings-page change on the existing App, not a default to grow into.
 const DEFAULT_PERMISSIONS = {
-  actions: 'read',
   contents: 'write',
-  issues: 'write',
   metadata: 'read',
   pull_requests: 'write',
   workflows: 'write',

package/src/structure-check.ts

@@ -13,6 +13,7 @@ import {
 } from './structure-profile';
 import { filteredTurboAliasProblem, hasSafeCommands } from './structure-script';
 import { collectCiSecretsProblems } from './structure-secrets';
+import { collectTurboLintProblems } from './structure-turbo';
 import { inspectWorkspace, type Workspace } from './structure-workspace';
 
 const ROOT_FIXED_SCRIPTS = new Set(
@@ -155,14 +156,17 @@ export const collectStructureProblems = async (
   consumer: string,
   profile: StructureProfile,
 ): Promise<ReadonlyArray<string>> => {
-  const [root, secretsProblems, callerProblems] = await Promise.all([
-    readJsonFile(join(consumer, 'package.json')),
-    collectCiSecretsProblems(consumer),
-    collectSopsActionCallerProblems(consumer),
-  ]);
+  const [root, turboProblems, secretsProblems, callerProblems] =
+    await Promise.all([
+      readJsonFile(join(consumer, 'package.json')),
+      collectTurboLintProblems(consumer),
+      collectCiSecretsProblems(consumer),
+      collectSopsActionCallerProblems(consumer),
+    ]);
   if (root === null) {
     return [
       'package.json must exist and contain a JSON object',
+      ...turboProblems,
       ...secretsProblems,
       ...callerProblems,
     ];
@@ -194,6 +198,7 @@ export const collectStructureProblems = async (
     ...missingPublishedCliProblems(profile, workspaces),
     ...collectBunVersionProblems(root),
     ...inspectRootScripts(root, profile, requireA11y),
+    ...turboProblems,
     ...inspections.flatMap((i) => [...i.problems]),
     ...secretsProblems,
     ...callerProblems,

package/src/structure-turbo.ts

@@ -0,0 +1,89 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isRecord } from './github-settings-parse';
+
+// The root gate runs `turbo run lint` and `turbo run lint:fix`, and Turbo runs
+// a root package.json script only through a task registered as `//#<name>`.
+// A plain `lint` task targets workspace scripts, which no longer exist, so
+// Turbo runs nothing and the gate passes without linting. A cache hit also
+// skips Biome: narrowed `//#lint` inputs let CI replay main's cached pass after
+// a linted file changes, and a cached `//#lint:fix` replays instead of fixing.
+const ROOT_LINT_TASK = '//#lint';
+const ROOT_LINT_FIX_TASK = '//#lint:fix';
+const LINT_TASK_NAMES: ReadonlyArray<string> = ['lint', 'lint:fix'];
+const ROOT_PACKAGE = '//';
+
+const readTurboConfig = async (
+  consumer: string,
+): Promise<Record<string, unknown> | null> => {
+  const raw = await readFile(join(consumer, 'turbo.json'), 'utf8').catch(
+    () => null,
+  );
+  if (raw === null) {
+    return null;
+  }
+  try {
+    // Turbo accepts comments and trailing commas in turbo.json.
+    const parsed: unknown = globalThis.Bun.JSONC.parse(raw);
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+};
+
+// Matches `lint`, `lint:fix`, and `<package>#lint(:fix)` overrides, but not
+// the root `//#` tasks.
+const isWorkspaceLintTask = (key: string): boolean => {
+  const separator = key.lastIndexOf('#');
+  const owner = separator === -1 ? null : key.slice(0, separator);
+  return (
+    owner !== ROOT_PACKAGE && LINT_TASK_NAMES.includes(key.slice(separator + 1))
+  );
+};
+
+const rootLintProblems = (
+  tasks: Record<string, unknown>,
+): ReadonlyArray<string> => {
+  const { [ROOT_LINT_TASK]: lint, [ROOT_LINT_FIX_TASK]: lintFix } = tasks;
+  return [
+    ...(isRecord(lint)
+      ? []
+      : [
+          `turbo.json: define the root task "${ROOT_LINT_TASK}" as { "outputs": [] }; Turbo runs the root "lint" script only through that task, so without it turbo run lint never runs Biome`,
+        ]),
+    ...(isRecord(lint) && Object.hasOwn(lint, 'inputs')
+      ? [
+          `turbo.json: remove "inputs" from the root task "${ROOT_LINT_TASK}"; the default inputs cover every file Biome checks, and a narrower set replays a cached pass after a linted file changes`,
+        ]
+      : []),
+    ...(isRecord(lintFix)
+      ? []
+      : [
+          `turbo.json: define the root task "${ROOT_LINT_FIX_TASK}" as { "cache": false, "outputs": [] }; Turbo runs the root "lint:fix" script only through that task, so without it turbo run lint:fix never runs Biome`,
+        ]),
+    ...(isRecord(lintFix) && lintFix.cache !== false
+      ? [
+          `turbo.json: set "cache": false on the root task "${ROOT_LINT_FIX_TASK}"; a cache hit replays the previous output instead of running Biome's fixes`,
+        ]
+      : []),
+  ];
+};
+
+export const collectTurboLintProblems = async (
+  consumer: string,
+): Promise<ReadonlyArray<string>> => {
+  const config = await readTurboConfig(consumer);
+  if (config === null) {
+    return ['turbo.json must exist and contain a JSON object'];
+  }
+  const tasks = isRecord(config.tasks) ? config.tasks : {};
+  return [
+    ...rootLintProblems(tasks),
+    ...Object.keys(tasks)
+      .filter(isWorkspaceLintTask)
+      .map(
+        (key) =>
+          `turbo.json: remove task "${key}"; linting runs once at the repository root through the root tasks "${ROOT_LINT_TASK}" and "${ROOT_LINT_FIX_TASK}"`,
+      ),
+  ];
+};