@regardio/dev 2.0.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -45
- package/docs/en/README.md +12 -17
- package/docs/en/standards/api.md +1 -1
- package/docs/en/standards/coding.md +1 -1
- package/docs/en/standards/naming.md +1 -1
- package/docs/en/standards/react.md +1 -1
- package/docs/en/standards/sql.md +2 -2
- package/docs/en/standards/testing.md +1 -1
- package/docs/en/tools/biome.md +34 -31
- package/docs/en/tools/commitlint.md +23 -27
- package/docs/en/tools/dependencies.md +43 -46
- package/docs/en/tools/husky.md +24 -26
- package/docs/en/tools/markdownlint.md +19 -22
- package/docs/en/tools/playwright.md +25 -25
- package/docs/en/tools/releases.md +19 -11
- package/docs/en/tools/typescript.md +23 -25
- package/docs/en/tools/vitest.md +30 -30
- package/package.json +6 -7
- package/docs/en/agents.md +0 -57
- package/docs/en/standards/documentation.md +0 -173
- package/docs/en/standards/principles.md +0 -84
- package/docs/en/standards/writing.md +0 -119
package/README.md
CHANGED
|
@@ -1,25 +1,25 @@
|
|
|
1
1
|
# @regardio/dev
|
|
2
2
|
|
|
3
|
-
A
|
|
3
|
+
A shared developer toolchain for TypeScript projects that want consistent quality without wrestling with configuration.
|
|
4
4
|
|
|
5
|
-
##
|
|
5
|
+
## What it's for
|
|
6
6
|
|
|
7
|
-
`@regardio/dev`
|
|
7
|
+
`@regardio/dev` is an opinionated, complete development environment that any JavaScript or TypeScript project can pull in. It bundles well-tested tools with defaults that work out of the box, so a team can reach for features instead of assembling tooling.
|
|
8
8
|
|
|
9
|
-
**One dependency.
|
|
9
|
+
**One dependency. No configuration tug-of-war. Steady quality across projects.**
|
|
10
10
|
|
|
11
|
-
##
|
|
11
|
+
## The idea
|
|
12
12
|
|
|
13
|
-
|
|
13
|
+
Balanced strictness: rigorous enough to catch trouble early and keep things consistent, loose enough to stay out of the way.
|
|
14
14
|
|
|
15
|
-
- **Strict by default**
|
|
16
|
-
- **Sensible defaults**
|
|
17
|
-
- **Minimal boilerplate**
|
|
18
|
-
- **Fast feedback**
|
|
15
|
+
- **Strict by default** — TypeScript strict mode, thorough linting, conventional commits
|
|
16
|
+
- **Sensible defaults** — shared configs that work on first install
|
|
17
|
+
- **Minimal boilerplate** — extend a preset, override only the odd line
|
|
18
|
+
- **Fast feedback** — quick linting and type-checking during development
|
|
19
19
|
|
|
20
|
-
The
|
|
20
|
+
The aim is code that's correct, consistent, and pleasant to work with — three things the industry likes to pretend are in tension.
|
|
21
21
|
|
|
22
|
-
## What's
|
|
22
|
+
## What's inside
|
|
23
23
|
|
|
24
24
|
| Category | Tools |
|
|
25
25
|
|----------|-------|
|
|
@@ -29,13 +29,13 @@ The goal is code that's correct, consistent, and a pleasure to work with.
|
|
|
29
29
|
| **Workflow** | Husky, GitLab Flow |
|
|
30
30
|
| **CLI utilities** | `ship-staging`, `ship-production`, `ship-hotfix` |
|
|
31
31
|
|
|
32
|
-
## Quick
|
|
32
|
+
## Quick start
|
|
33
33
|
|
|
34
34
|
```bash
|
|
35
35
|
pnpm add -D @regardio/dev
|
|
36
36
|
```
|
|
37
37
|
|
|
38
|
-
Extend the shared configs
|
|
38
|
+
Extend the shared configs:
|
|
39
39
|
|
|
40
40
|
```jsonc
|
|
41
41
|
// biome.jsonc
|
|
@@ -47,47 +47,39 @@ Extend the shared configs in your project:
|
|
|
47
47
|
|
|
48
48
|
## Documentation
|
|
49
49
|
|
|
50
|
-
|
|
50
|
+
Documentation sits alongside the code, organised by topic. Cross-project standards — principles, writing voice, documentation shape — live outside this package at [`commons/docs/en/`](../../docs/en/README.md), since they apply well beyond TypeScript.
|
|
51
51
|
|
|
52
|
-
###
|
|
52
|
+
### Code standards
|
|
53
53
|
|
|
54
|
-
- [
|
|
55
|
-
- [
|
|
56
|
-
- [
|
|
57
|
-
- [
|
|
58
|
-
- [
|
|
59
|
-
- [
|
|
60
|
-
- [
|
|
61
|
-
- [React](./docs/en/standards/react.md) - React and TypeScript development patterns
|
|
62
|
-
- [SQL](./docs/en/standards/sql.md) - PostgreSQL schema styling, structure, and access control
|
|
63
|
-
- [Testing](./docs/en/standards/testing.md) - Testing philosophy and patterns
|
|
64
|
-
- [Writing](./docs/en/standards/writing.md) - Voice, tone, and language for content
|
|
54
|
+
- [API](./docs/en/standards/api.md) — API design and implementation
|
|
55
|
+
- [Coding](./docs/en/standards/coding.md) — TypeScript, React, and general patterns
|
|
56
|
+
- [Commits](./docs/en/standards/commits.md) — conventional commits and changelog generation
|
|
57
|
+
- [Naming](./docs/en/standards/naming.md) — consistent naming across languages
|
|
58
|
+
- [React](./docs/en/standards/react.md) — React and TypeScript patterns
|
|
59
|
+
- [SQL](./docs/en/standards/sql.md) — PostgreSQL schema, structure, access control
|
|
60
|
+
- [Testing](./docs/en/standards/testing.md) — testing philosophy and patterns
|
|
65
61
|
|
|
66
62
|
### Toolchain
|
|
67
63
|
|
|
68
|
-
- [Biome](./docs/en/tools/biome.md)
|
|
69
|
-
- [Commitlint](./docs/en/tools/commitlint.md) -
|
|
70
|
-
- [Dependencies](./docs/en/tools/dependencies.md)
|
|
71
|
-
- [Husky](./docs/en/tools/husky.md)
|
|
72
|
-
- [Markdownlint](./docs/en/tools/markdownlint.md)
|
|
73
|
-
- [Playwright](./docs/en/tools/playwright.md)
|
|
74
|
-
- [Releases](./docs/en/tools/releases.md)
|
|
75
|
-
- [TypeScript](./docs/en/tools/typescript.md)
|
|
76
|
-
- [Vitest](./docs/en/tools/vitest.md)
|
|
64
|
+
- [Biome](./docs/en/tools/biome.md) — linting and formatting
|
|
65
|
+
- [Commitlint](./docs/en/tools/commitlint.md) — commit-message validation
|
|
66
|
+
- [Dependencies](./docs/en/tools/dependencies.md) — safe dependency updates and supply-chain controls
|
|
67
|
+
- [Husky](./docs/en/tools/husky.md) — git hooks
|
|
68
|
+
- [Markdownlint](./docs/en/tools/markdownlint.md) — markdown quality
|
|
69
|
+
- [Playwright](./docs/en/tools/playwright.md) — end-to-end testing
|
|
70
|
+
- [Releases](./docs/en/tools/releases.md) — branch-based release flow with Changesets
|
|
71
|
+
- [TypeScript](./docs/en/tools/typescript.md) — strict TypeScript configuration
|
|
72
|
+
- [Vitest](./docs/en/tools/vitest.md) — unit and integration testing
|
|
77
73
|
|
|
78
74
|
## Portability
|
|
79
75
|
|
|
80
|
-
|
|
76
|
+
The toolchain is designed for Regardio projects, but nothing about it ties it to Regardio. Any TypeScript project can adopt it:
|
|
81
77
|
|
|
82
|
-
-
|
|
83
|
-
- No proprietary conventions
|
|
84
|
-
-
|
|
85
|
-
- MIT
|
|
78
|
+
- Configs extend official tool presets
|
|
79
|
+
- No proprietary conventions, no lock-in
|
|
80
|
+
- Distributed as a standard npm package
|
|
81
|
+
- MIT-licensed
|
|
86
82
|
|
|
87
83
|
## License
|
|
88
84
|
|
|
89
85
|
MIT © [Regardio](https://regard.io)
|
|
90
|
-
|
|
91
|
-
## Acknowledgments
|
|
92
|
-
|
|
93
|
-
Built on the shoulders of giants: [Biome](https://biomejs.dev/), [TypeScript](https://www.typescriptlang.org/), [Vitest](https://vitest.dev/), [Playwright](https://playwright.dev/), [Vite](https://vitejs.dev/), and the entire open source ecosystem.
|
package/docs/en/README.md
CHANGED
|
@@ -1,34 +1,29 @@
|
|
|
1
1
|
---
|
|
2
2
|
|
|
3
|
-
title: @regardio/dev Documentation
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
locale: en-US
|
|
3
|
+
title: "@regardio/dev Documentation"
|
|
4
|
+
description: "Index for the @regardio/dev toolchain — code-level standards and the tools that enforce them."
|
|
5
|
+
publishedAt: 2026-04-17
|
|
6
|
+
language: "en"
|
|
7
|
+
status: "published"
|
|
9
8
|
---
|
|
10
9
|
|
|
11
10
|
# Documentation
|
|
12
11
|
|
|
13
|
-
|
|
12
|
+
Index for the `@regardio/dev` toolchain.
|
|
14
13
|
|
|
15
|
-
|
|
14
|
+
Cross-project standards — voice, documentation shape, principles — live at the commons root in [`docs/en/`](../../../../docs/en/README.md). The documents below are the code-level standards and the tools that enforce them.
|
|
16
15
|
|
|
17
|
-
|
|
16
|
+
## Code standards
|
|
18
17
|
|
|
19
18
|
| Document | Description |
|
|
20
19
|
|----------|-------------|
|
|
21
|
-
| [
|
|
22
|
-
| [API](./standards/api.md) | API design and implementation guidelines |
|
|
20
|
+
| [API](./standards/api.md) | API design and implementation |
|
|
23
21
|
| [Coding](./standards/coding.md) | TypeScript, React, and general patterns |
|
|
24
22
|
| [Commits](./standards/commits.md) | Conventional commits and changelog generation |
|
|
25
|
-
| [Documentation](./standards/documentation.md) | Documentation structure and conventions |
|
|
26
23
|
| [Naming](./standards/naming.md) | Consistent naming across languages |
|
|
27
|
-
| [
|
|
28
|
-
| [
|
|
29
|
-
| [SQL](./standards/sql.md) | PostgreSQL schema styling, structure, and access control |
|
|
24
|
+
| [React](./standards/react.md) | React and TypeScript patterns |
|
|
25
|
+
| [SQL](./standards/sql.md) | PostgreSQL schema, structure, access control |
|
|
30
26
|
| [Testing](./standards/testing.md) | Testing philosophy and patterns |
|
|
31
|
-
| [Writing](./standards/writing.md) | Voice, tone, and language |
|
|
32
27
|
|
|
33
28
|
## Toolchain
|
|
34
29
|
|
|
@@ -76,7 +71,7 @@ pnpm typecheck # TypeScript type checking
|
|
|
76
71
|
| `pnpm-workspace.yaml` | Workspace dependency and supply-chain policy |
|
|
77
72
|
| `tsconfig.json` | TypeScript configuration |
|
|
78
73
|
| `vitest.config.ts` | Unit test configuration |
|
|
79
|
-
| `.sqlfluff` | SQL linting (copy from
|
|
74
|
+
| `.sqlfluff` | SQL linting (copy from `node_modules/@regardio/dev/templates/sqlfluff/setup.cfg`) |
|
|
80
75
|
|
|
81
76
|
### Extending Presets
|
|
82
77
|
|
package/docs/en/standards/api.md
CHANGED
|
@@ -317,7 +317,7 @@ describe('User API', () => {
|
|
|
317
317
|
- [React](./react.md) — Patterns for the clients that consume the API
|
|
318
318
|
- [SQL](./sql.md) — Naming, structure, and access on the database side
|
|
319
319
|
- [Testing](./testing.md) — Testing philosophy and layers
|
|
320
|
-
- [Principles](
|
|
320
|
+
- [Principles](../../../../../docs/en/principles.md) — Shared principles
|
|
321
321
|
|
|
322
322
|
---
|
|
323
323
|
|
|
@@ -134,7 +134,7 @@ An unjustified suppression is a regression.
|
|
|
134
134
|
|
|
135
135
|
## Related
|
|
136
136
|
|
|
137
|
-
- [Principles](
|
|
137
|
+
- [Principles](../../../../../docs/en/principles.md) — Shared principles the patterns build on
|
|
138
138
|
- [React](./react.md) — Component, hook, and state patterns
|
|
139
139
|
- [Naming](./naming.md) — Names across languages
|
|
140
140
|
- [Testing](./testing.md) — Testing philosophy
|
|
@@ -173,7 +173,7 @@ NODE_ENV=production
|
|
|
173
173
|
- [Coding](./coding.md) — TypeScript and general patterns
|
|
174
174
|
- [SQL](./sql.md) — PostgreSQL naming, structure, and access
|
|
175
175
|
- [Commits](./commits.md) — Branch and commit naming
|
|
176
|
-
- [Writing](
|
|
176
|
+
- [Writing](../../../../../docs/en/writing.md) — Voice, tone, language
|
|
177
177
|
|
|
178
178
|
---
|
|
179
179
|
|
|
@@ -238,7 +238,7 @@ describe('SearchForm', () => {
|
|
|
238
238
|
|
|
239
239
|
- [Coding](./coding.md) — TypeScript patterns React code builds on
|
|
240
240
|
- [Testing](./testing.md) — Testing philosophy and layers
|
|
241
|
-
- [Principles](
|
|
241
|
+
- [Principles](../../../../../docs/en/principles.md) — Shared principles across the stack
|
|
242
242
|
- [Naming](./naming.md) — Names across languages
|
|
243
243
|
|
|
244
244
|
---
|
package/docs/en/standards/sql.md
CHANGED
|
@@ -250,8 +250,8 @@ create policy pol_task_update on public.task
|
|
|
250
250
|
|
|
251
251
|
- [Naming](./naming.md) — Names across languages
|
|
252
252
|
- [API](./api.md) — How the schema is consumed
|
|
253
|
-
- [Principles](
|
|
254
|
-
- [Writing](
|
|
253
|
+
- [Principles](../../../../../docs/en/principles.md) — Shared principles
|
|
254
|
+
- [Writing](../../../../../docs/en/writing.md) — Voice, tone, language
|
|
255
255
|
|
|
256
256
|
---
|
|
257
257
|
|
|
@@ -128,7 +128,7 @@ Before a package publishes:
|
|
|
128
128
|
|
|
129
129
|
## Related
|
|
130
130
|
|
|
131
|
-
- [Principles](
|
|
131
|
+
- [Principles](../../../../../docs/en/principles.md) — Shared principles, including specification-led workflow
|
|
132
132
|
- [React](./react.md) — How components are shaped to be testable
|
|
133
133
|
- [API](./api.md) — Testing API endpoints and contracts
|
|
134
134
|
- [Vitest](../tools/vitest.md) — Unit and integration testing
|
package/docs/en/tools/biome.md
CHANGED
|
@@ -1,20 +1,21 @@
|
|
|
1
1
|
---
|
|
2
2
|
|
|
3
|
-
title: Biome
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
3
|
+
title: "Biome"
|
|
4
|
+
description: "Linting and formatting for JavaScript and TypeScript, configured centrally through @regardio/dev."
|
|
5
|
+
publishedAt: 2026-04-17
|
|
6
|
+
language: "en"
|
|
7
|
+
status: "published"
|
|
8
|
+
kind: "guide"
|
|
9
|
+
area: "dev"
|
|
9
10
|
---
|
|
10
11
|
|
|
11
12
|
# Biome
|
|
12
13
|
|
|
13
|
-
|
|
14
|
+
[Biome](https://biomejs.dev/) is the linter and formatter every Regardio package reaches for. Configuration is centralised through `@regardio/dev`, and wrapper commands keep every package behaving the same way.
|
|
14
15
|
|
|
15
16
|
## Configuration
|
|
16
17
|
|
|
17
|
-
|
|
18
|
+
A `biome.jsonc` at the package root is all it takes:
|
|
18
19
|
|
|
19
20
|
```jsonc
|
|
20
21
|
{
|
|
@@ -36,54 +37,56 @@ Create `biome.jsonc` in your package root:
|
|
|
36
37
|
}
|
|
37
38
|
```
|
|
38
39
|
|
|
39
|
-
## CLI
|
|
40
|
+
## CLI wrapper
|
|
40
41
|
|
|
41
|
-
Use `lint-biome`
|
|
42
|
+
Use `lint-biome` rather than `biome` directly — the wrapper keeps behaviour consistent across the monorepo.
|
|
42
43
|
|
|
43
44
|
```bash
|
|
44
45
|
lint-biome check . # Check for issues
|
|
45
|
-
lint-biome check --write . # Fix auto-fixable
|
|
46
|
+
lint-biome check --write . # Fix the auto-fixable
|
|
46
47
|
lint-biome format . # Format only
|
|
47
48
|
```
|
|
48
49
|
|
|
49
|
-
##
|
|
50
|
+
## `package.json` handling
|
|
50
51
|
|
|
51
|
-
The Biome preset
|
|
52
|
+
The Biome preset leaves `package.json` alone. For those files, `lint-package` does the work:
|
|
52
53
|
|
|
53
|
-
1. Sorts package.json using the well-known field order
|
|
54
|
-
2. Fixes
|
|
54
|
+
1. Sorts `package.json` using the well-known field order
|
|
55
|
+
2. Fixes export-condition order (`types` before `default` for TypeScript)
|
|
55
56
|
|
|
56
57
|
```bash
|
|
57
58
|
lint-package # Sort package.json in current directory
|
|
58
|
-
lint-package path/to/pkg # Sort specific package.json
|
|
59
|
+
lint-package path/to/pkg # Sort a specific package.json
|
|
59
60
|
```
|
|
60
61
|
|
|
61
|
-
|
|
62
|
+
It runs automatically as part of `pnpm fix`.
|
|
62
63
|
|
|
63
|
-
## Rule
|
|
64
|
+
## Rule categories
|
|
64
65
|
|
|
65
|
-
The preset enables rules across
|
|
66
|
+
The preset enables rules across:
|
|
66
67
|
|
|
67
|
-
- **Correctness**
|
|
68
|
-
- **Style**
|
|
69
|
-
- **Complexity**
|
|
70
|
-
- **Performance**
|
|
71
|
-
- **Security**
|
|
68
|
+
- **Correctness** — catch bugs and incorrect code
|
|
69
|
+
- **Style** — consistent code formatting
|
|
70
|
+
- **Complexity** — prevent overly complex code
|
|
71
|
+
- **Performance** — flag performance issues
|
|
72
|
+
- **Security** — flag possible vulnerabilities
|
|
72
73
|
|
|
73
|
-
## Ignoring
|
|
74
|
+
## Ignoring rules
|
|
74
75
|
|
|
75
|
-
When a rule genuinely doesn't apply,
|
|
76
|
+
When a rule genuinely doesn't apply, an inline comment names the exception:
|
|
76
77
|
|
|
77
78
|
```typescript
|
|
78
79
|
// biome-ignore lint/complexity/noForEach: forEach is clearer here for side effects
|
|
79
80
|
items.forEach(item => process(item));
|
|
80
81
|
```
|
|
81
82
|
|
|
82
|
-
Always include a reason
|
|
83
|
+
Always include a reason — an unjustified suppression is a regression waiting to spread.
|
|
83
84
|
|
|
84
|
-
## Editor
|
|
85
|
+
## Editor integration
|
|
85
86
|
|
|
86
|
-
-
|
|
87
|
-
- **JetBrains**: Built-in support via settings
|
|
87
|
+
Most editors pick up `biome.jsonc` automatically through a Biome plugin or built-in support. If the editor formats on save, point it at Biome rather than another formatter so the two don't fight over the same file.
|
|
88
88
|
|
|
89
|
-
|
|
89
|
+
## Related
|
|
90
|
+
|
|
91
|
+
- [TypeScript](./typescript.md) — strict TypeScript configuration
|
|
92
|
+
- [Markdownlint](./markdownlint.md) — linting and formatting for Markdown
|
|
@@ -1,20 +1,21 @@
|
|
|
1
1
|
---
|
|
2
2
|
|
|
3
|
-
title: Commitlint
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
3
|
+
title: "Commitlint"
|
|
4
|
+
description: "Validates commit messages against the conventional format through git hooks."
|
|
5
|
+
publishedAt: 2026-04-17
|
|
6
|
+
language: "en"
|
|
7
|
+
status: "published"
|
|
8
|
+
kind: "guide"
|
|
9
|
+
area: "dev"
|
|
9
10
|
---
|
|
10
11
|
|
|
11
12
|
# Commitlint
|
|
12
13
|
|
|
13
|
-
|
|
14
|
+
Commitlint checks commit messages against the conventional-commits format through git hooks. The rules live in `@regardio/dev`; projects extend them without restating them.
|
|
14
15
|
|
|
15
16
|
## Configuration
|
|
16
17
|
|
|
17
|
-
At the workspace root,
|
|
18
|
+
At the workspace root, a `.commitlintrc.json`:
|
|
18
19
|
|
|
19
20
|
```json
|
|
20
21
|
{
|
|
@@ -22,14 +23,14 @@ At the workspace root, create `.commitlintrc.json`:
|
|
|
22
23
|
}
|
|
23
24
|
```
|
|
24
25
|
|
|
25
|
-
Or
|
|
26
|
+
Or, for projects that prefer JavaScript config:
|
|
26
27
|
|
|
27
28
|
```javascript
|
|
28
29
|
// commitlint.config.cjs
|
|
29
30
|
module.exports = require('@regardio/dev/commitlint');
|
|
30
31
|
```
|
|
31
32
|
|
|
32
|
-
## Commit
|
|
33
|
+
## Commit format
|
|
33
34
|
|
|
34
35
|
```text
|
|
35
36
|
<type>(<scope>): <subject>
|
|
@@ -52,7 +53,7 @@ module.exports = require('@regardio/dev/commitlint');
|
|
|
52
53
|
| `test` | Adding or updating tests |
|
|
53
54
|
| `build` | Build system or dependencies |
|
|
54
55
|
| `ci` | CI configuration |
|
|
55
|
-
| `chore` | Other changes (tooling,
|
|
56
|
+
| `chore` | Other changes (tooling, and so on) |
|
|
56
57
|
| `revert` | Revert a previous commit |
|
|
57
58
|
|
|
58
59
|
### Examples
|
|
@@ -68,25 +69,20 @@ feat(auth): implement OAuth2 flow
|
|
|
68
69
|
fix(api): handle null response gracefully
|
|
69
70
|
```
|
|
70
71
|
|
|
71
|
-
## Rules
|
|
72
|
+
## Rules the preset enforces
|
|
72
73
|
|
|
73
|
-
|
|
74
|
+
- **Header max length** — 100 characters
|
|
75
|
+
- **Body leading blank** — blank line before the body
|
|
76
|
+
- **Footer leading blank** — blank line before the footer
|
|
77
|
+
- **Type enum** — one of the allowed types, nothing exotic
|
|
74
78
|
|
|
75
|
-
|
|
76
|
-
- **Body leading blank**: Blank line before body
|
|
77
|
-
- **Footer leading blank**: Blank line before footer
|
|
78
|
-
- **Type enum**: Must be one of the allowed types
|
|
79
|
+
## Git hooks
|
|
79
80
|
|
|
80
|
-
|
|
81
|
+
Commitlint runs automatically through Husky on commit. See [Husky](./husky.md) for setup.
|
|
81
82
|
|
|
82
|
-
|
|
83
|
+
## Related
|
|
83
84
|
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
- [
|
|
87
|
-
- [Husky](./husky.md) — Git hooks for quality gates
|
|
88
|
-
|
|
89
|
-
### Resources
|
|
90
|
-
|
|
91
|
-
- [Conventional Commits](https://www.conventionalcommits.org/)
|
|
85
|
+
- [Commits](../standards/commits.md) — conventional commits and changelog generation
|
|
86
|
+
- [Husky](./husky.md) — git hooks for quality gates
|
|
87
|
+
- [Conventional Commits](https://www.conventionalcommits.org/) — the specification behind all this
|
|
92
88
|
- [Commitlint Documentation](https://commitlint.js.org/)
|
|
@@ -1,24 +1,25 @@
|
|
|
1
1
|
---
|
|
2
2
|
|
|
3
|
-
title: Dependency Handling
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
3
|
+
title: "Dependency Handling"
|
|
4
|
+
description: "How Regardio workspaces keep dependencies up to date without letting the supply chain surprise them."
|
|
5
|
+
publishedAt: 2026-04-17
|
|
6
|
+
language: "en"
|
|
7
|
+
status: "published"
|
|
8
|
+
kind: "guide"
|
|
9
|
+
area: "dev"
|
|
9
10
|
---
|
|
10
11
|
|
|
11
12
|
# Dependency Handling
|
|
12
13
|
|
|
13
|
-
Dependency
|
|
14
|
+
Dependency updates in a Regardio workspace walk a narrow path: automated update tooling on one side, pnpm guardrails on the other, and the lockfile as the final word.
|
|
14
15
|
|
|
15
16
|
## Update workflow
|
|
16
17
|
|
|
17
|
-
-
|
|
18
|
-
-
|
|
19
|
-
-
|
|
18
|
+
- `pnpm ncu` prepares the upgrade proposals
|
|
19
|
+
- Installs go through `pnpm` so workspace-level safety settings apply
|
|
20
|
+
- The normal verification flow runs after an update
|
|
20
21
|
|
|
21
|
-
The root `ncu` script uses a 1-day cooldown so it
|
|
22
|
+
The root `ncu` script uses a 1-day cooldown, so it won't propose versions newer than the workspace's release-age policy allows anyway.
|
|
22
23
|
|
|
23
24
|
```bash
|
|
24
25
|
pnpm audit
|
|
@@ -28,7 +29,7 @@ pnpm test
|
|
|
28
29
|
pnpm typecheck
|
|
29
30
|
```
|
|
30
31
|
|
|
31
|
-
For larger
|
|
32
|
+
For larger upgrade passes, the safety wrapper pulls everything together:
|
|
32
33
|
|
|
33
34
|
```bash
|
|
34
35
|
pnpm safe-upgrade
|
|
@@ -36,15 +37,13 @@ pnpm safe-upgrade
|
|
|
36
37
|
|
|
37
38
|
## Workspace safety settings
|
|
38
39
|
|
|
39
|
-
The root `pnpm-workspace.yaml`
|
|
40
|
+
The root `pnpm-workspace.yaml` carries the main supply-chain controls.
|
|
40
41
|
|
|
41
42
|
### Allow-listed dependency builds
|
|
42
43
|
|
|
43
|
-
|
|
44
|
+
Build scripts stay restricted through `onlyBuiltDependencies`. A dependency cannot run `build` or `postinstall` unless it's already trusted and listed explicitly. If a package that never needed a build step adds one in a compromised release, pnpm doesn't run it — the workspace notices before the damage does.
|
|
44
45
|
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
When a legitimate dependency genuinely needs a build step, add it deliberately to the allow-list and review why it is required.
|
|
46
|
+
When a legitimate dependency genuinely needs a build step, add it deliberately to the allow-list and leave a note on why.
|
|
48
47
|
|
|
49
48
|
### Block exotic transitive dependencies
|
|
50
49
|
|
|
@@ -52,7 +51,7 @@ When a legitimate dependency genuinely needs a build step, add it deliberately t
|
|
|
52
51
|
blockExoticSubdeps: true
|
|
53
52
|
```
|
|
54
53
|
|
|
55
|
-
|
|
54
|
+
Transitive dependencies can't resolve through git URLs, tarballs, or other non-registry sources. The registry remains the only door in.
|
|
56
55
|
|
|
57
56
|
### Delay newly published versions
|
|
58
57
|
|
|
@@ -60,9 +59,9 @@ This prevents transitive dependencies from resolving through git URLs, tarballs,
|
|
|
60
59
|
minimumReleaseAge: 1440
|
|
61
60
|
```
|
|
62
61
|
|
|
63
|
-
|
|
62
|
+
pnpm waits 24 hours before installing a newly published version. That window is long enough for most compromised packages to be detected and pulled before they land in a workspace.
|
|
64
63
|
|
|
65
|
-
The root `ncu` script mirrors this with `--cooldown 1`, which
|
|
64
|
+
The root `ncu` script mirrors this with `--cooldown 1`, which lines version selection up with the install policy. pnpm is still the authoritative enforcement point at install time.
|
|
66
65
|
|
|
67
66
|
### Prevent trust downgrades
|
|
68
67
|
|
|
@@ -70,47 +69,45 @@ The root `ncu` script mirrors this with `--cooldown 1`, which helps align versio
|
|
|
70
69
|
trustPolicy: no-downgrade
|
|
71
70
|
```
|
|
72
71
|
|
|
73
|
-
If a package release becomes less trustworthy than earlier releases, pnpm
|
|
72
|
+
If a package release becomes less trustworthy than earlier releases, pnpm refuses to install it rather than silently accepting the downgrade.
|
|
74
73
|
|
|
75
|
-
`npm-check-updates` does not enforce trust policy, build-script allow-lists, or exotic
|
|
74
|
+
`npm-check-updates` does not enforce trust policy, build-script allow-lists, or exotic-source restrictions. Those safeguards take effect when `pnpm install` resolves and installs — not before.
|
|
76
75
|
|
|
77
76
|
## Lockfile discipline
|
|
78
77
|
|
|
79
|
-
-
|
|
80
|
-
-
|
|
81
|
-
- Prefer
|
|
78
|
+
- `pnpm-lock.yaml` is committed
|
|
79
|
+
- Lockfile changes are reviewed alongside manifest changes
|
|
80
|
+
- Prefer regular installs over ad-hoc per-package commands so the workspace lock stays authoritative
|
|
82
81
|
|
|
83
82
|
## Reviewing dependency updates
|
|
84
83
|
|
|
85
|
-
When an automated update lands,
|
|
84
|
+
When an automated update lands, a few questions are worth asking:
|
|
86
85
|
|
|
87
|
-
-
|
|
88
|
-
-
|
|
89
|
-
-
|
|
90
|
-
-
|
|
86
|
+
- Is the package direct or transitive?
|
|
87
|
+
- Does the update add or change a build requirement?
|
|
88
|
+
- Does the package affect runtime, build tooling, or release tooling?
|
|
89
|
+
- Do any newly disclosed vulnerabilities want a workspace override?
|
|
91
90
|
|
|
92
91
|
## Shipping dependency changes
|
|
93
92
|
|
|
94
|
-
Dependency updates
|
|
95
|
-
|
|
96
|
-
- verify locally before shipping
|
|
97
|
-
- keep changelog subjects clear when a release is primarily dependency maintenance
|
|
98
|
-
- use provenance when publishing public packages
|
|
93
|
+
Dependency updates go through the same release gates as any other change.
|
|
99
94
|
|
|
100
|
-
|
|
95
|
+
- Verify locally before shipping
|
|
96
|
+
- Keep changelog subjects clear when the release is primarily dependency maintenance
|
|
97
|
+
- Use provenance when publishing public packages
|
|
101
98
|
|
|
102
|
-
|
|
99
|
+
## When an exception is warranted
|
|
103
100
|
|
|
104
|
-
|
|
101
|
+
Exceptions stay explicit and rare. A few examples of what qualifies:
|
|
105
102
|
|
|
106
|
-
-
|
|
107
|
-
-
|
|
108
|
-
-
|
|
103
|
+
- Adding a package to `onlyBuiltDependencies`
|
|
104
|
+
- Introducing a workspace override for a vulnerable transitive dependency
|
|
105
|
+
- Reducing the release-age delay for a security-critical emergency update
|
|
109
106
|
|
|
110
|
-
When an exception is
|
|
107
|
+
When an exception is needed, record the reason in the change itself — later readers will thank whoever left the note.
|
|
111
108
|
|
|
112
|
-
Related
|
|
109
|
+
## Related
|
|
113
110
|
|
|
114
|
-
- [
|
|
115
|
-
- [Testing
|
|
116
|
-
- [TypeScript
|
|
111
|
+
- [Releases](./releases.md) — the release process dependency changes pass through
|
|
112
|
+
- [Testing](../standards/testing.md) — the layer that catches what slips past the update review
|
|
113
|
+
- [TypeScript](./typescript.md) — TypeScript configuration for Regardio projects
|