Repository navigation
Adopt maintained static-analysis libraries and CI gates #997
Description
Goal
Adopt maintained static-analysis libraries and pinned external CI checks, then use their findings to delete code and dependencies. Do not add repository-authored analyzers, metric collectors, baseline files, suppression machinery, or wrappers that become a second codebase to maintain.
The motivating tweet is directionally useful: agent-authored code should face strict, immediate limits. For Ultrafuzz, the simplest implementation is established tools with absolute policies on changed code—not custom ratchets around a legacy baseline.
Ultrafuzz is a TypeScript/pnpm monorepo with a Vite/React dashboard, not a Next.js application.
Maintained gates to land
- ESLint flat config + typescript-eslint: cover JS, CJS, MJS, TS, and TSX; retain the existing compatible lint; apply
strictand type-awarestrictTypeCheckedwith Project Service to changed source viaeslint-plugin-diff; reject unused disable directives. - Native ESLint budgets on changed code: cyclomatic complexity, depth, file/function length, parameters, statements, nested callbacks,
console, and TODO/FIXME comments, with a separate absolute test/template profile. - Knip 6.33.0: reject orphan files, unused dependencies, unlisted dependencies, and unresolved imports across the pnpm workspaces. Configure only real dynamic entry points/imports.
- Size Limit 13.0.3: enforce Brotli budgets for the built dashboard JavaScript and CSS artifacts.
- Super-Linter slim 8.7.0, pinned by full commit SHA, in required changed-file CI. Use its maintained integrations for Actionlint/ShellCheck, Zizmor, Gitleaks, Hadolint, Stylelint, shfmt, HTMLHint, JSON/JSONC, YAML, Markdown, and dotenv checks.
- Apply Zizmor's checkout recommendation (
persist-credentials: false) throughout the workflow.
Simplification requirement
Tool findings must be resolved by deletion or direct configuration, without checked-in baselines or broad suppressions.
The implementation removes five orphan files (549 lines), unused declarations/exports, and three unused package dependencies. Its final diff is 245 additions and 716 deletions: net -471 lines. All production source changes are deletions.
Evaluated, not added
| Candidate | Decision |
|---|---|
| SonarJS, Unicorn, regexp, and Node ESLint presets | Do not stack broad presets over the authoritative ESLint lane. Dry runs produced large legacy violation sets without a deletion-only path; native ESLint and typed typescript-eslint supply the blocking checks in this change. |
| Ultracite, Biome, Oxlint | Do not add duplicate lint/format authorities. Revisit only as a measured replacement for ESLint + Prettier. |
| dependency-cruiser, Madge | Current runtime cycles prevent an absolute no-cycle gate. Do not create a baseline or second architecture model; Knip supplies the immediately clean dependency checks. |
| jscpd | The current tree has substantial existing clones. Do not commit a duplication baseline; adopt only after deletion/refactoring can make an absolute threshold honest. |
| type-coverage | Typed ESLint already catches unsafe any leakage on changed source; do not add a redundant aggregate ratchet. |
| ast-grep | Custom repository rules and fixtures would violate the no-authored-gates constraint. |
| Standalone Stylelint/actionlint/zizmor/ShellCheck/Hadolint/Gitleaks workflows | Use the pinned Super-Linter integrations instead of maintaining several equivalent CI definitions. |
| CodeQL and dependency review | GitHub-hosted features are unavailable for this private repository under its current plan/settings. Keep the existing production advisory policy plus Gitleaks. |
| Next.js checks | Inapplicable: the dashboard uses Vite. |
| Stryker, coverage, Lighthouse, startup timing | Useful dynamic quality/performance checks, but not static analysis and not part of this issue. |
| publint, Are The Types Wrong | Defer while every workspace package is private; the existing packed-install validation remains authoritative. |
Acceptance criteria
- Required PR CI runs only maintained external analyzers and library configuration added here.
- Tool/action versions are exact or commit-SHA pinned.
- No custom analyzer, baseline, suppression registry, or generated metrics snapshot is added.
- TSX and CJS are no longer omitted from ESLint.
- Existing code passes the compatibility lint; strict typed and complexity checks reject violations on changed lines.
- Knip, Size Limit, Actionlint/ShellCheck, Zizmor, formatting, build, and frozen install pass locally.
- The patch removes substantially more code than it adds.
Activity
fix(runtime): pin the manifest path and cover the repair end to end
fix(runtime): publish the sealed prompt path from a refreshed control…
[-]Establish ratcheted agent-oriented static-analysis and quality-budget gates[/-][+]Adopt maintained static-analysis libraries and CI gates[/+]