.gitea/workflows/ci.yml

@@ -352,7 +352,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0  # Required: base.sha must be locally available for git log range (Pitfall 3)
+          fetch-depth: 0 # Required: base.sha must be locally available for git log range (Pitfall 3)
 
       # ── Probe PR base/head SHA with merge-base fallback (A2 / OQ-1) ──────────
       # github.event.pull_request.base.sha may be empty on some Gitea versions.

apps/api/tests/lib/bootGuards.test.ts

@@ -28,11 +28,9 @@ describe('assertNotDevBypassInProduction', () => {
     process.env.NODE_ENV = 'production';
     process.env.DEV_AUTH_BYPASS = 'true';
 
-    const exitSpy = vi
-      .spyOn(process, 'exit')
-      .mockImplementation((() => {
-        throw new Error('process.exit called');
-      }) as never);
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
+      throw new Error('process.exit called');
+    }) as never);
 
     expect(() => assertNotDevBypassInProduction()).toThrow('process.exit called');
     expect(exitSpy).toHaveBeenCalledWith(1);
@@ -44,11 +42,9 @@ describe('assertNotDevBypassInProduction', () => {
     process.env.NODE_ENV = 'development';
     process.env.DEV_AUTH_BYPASS = 'true';
 
-    const exitSpy = vi
-      .spyOn(process, 'exit')
-      .mockImplementation((() => {
-        throw new Error('process.exit called');
-      }) as never);
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
+      throw new Error('process.exit called');
+    }) as never);
 
     expect(() => assertNotDevBypassInProduction()).not.toThrow();
     expect(exitSpy).not.toHaveBeenCalled();
@@ -60,11 +56,9 @@ describe('assertNotDevBypassInProduction', () => {
     process.env.NODE_ENV = 'production';
     delete process.env.DEV_AUTH_BYPASS;
 
-    const exitSpy = vi
-      .spyOn(process, 'exit')
-      .mockImplementation((() => {
-        throw new Error('process.exit called');
-      }) as never);
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
+      throw new Error('process.exit called');
+    }) as never);
 
     expect(() => assertNotDevBypassInProduction()).not.toThrow();
     expect(exitSpy).not.toHaveBeenCalled();

scripts/__tests__/check-audit.test.mjs

@@ -14,7 +14,7 @@ import { selectBlocking, partitionAdvisories, isWaived } from '../check-audit.mj
 
 // Fixture: a High advisory not in the allowlist
 const highUnwaived = {
-  '1': {
+  1: {
     severity: 'high',
     github_advisory_id: 'GHSA-test-unwaived-high',
     module_name: 'some-package',
@@ -24,7 +24,7 @@ const highUnwaived = {
 
 // Fixture: a High advisory that IS in the allowlist
 const highWaived = {
-  '2': {
+  2: {
     severity: 'high',
     github_advisory_id: 'GHSA-gv7w-rqvm-qjhr',
     module_name: 'esbuild',
@@ -34,13 +34,13 @@ const highWaived = {
 
 // Fixture: only moderate/low advisories
 const moderateLow = {
-  '3': {
+  3: {
     severity: 'moderate',
     github_advisory_id: 'GHSA-mod-erate-test',
     module_name: 'another-package',
     title: 'Moderate vulnerability',
   },
-  '4': {
+  4: {
     severity: 'low',
     github_advisory_id: 'GHSA-low-test-only',
     module_name: 'yet-another',

scripts/check-outdated.mjs

@@ -62,7 +62,9 @@ try {
   pins = JSON.parse(readFileSync(pinsPath, 'utf8'));
 } catch {
   // Gracefully degrade — no pins means everything is treated as unpinned
-  console.warn('[check-outdated] Warning: could not read outdated-pins.json; treating all pins as unknown');
+  console.warn(
+    '[check-outdated] Warning: could not read outdated-pins.json; treating all pins as unknown',
+  );
 }
 
 // ── Run pnpm audit to collect vulnerable module names ───────────────────────
@@ -78,7 +80,9 @@ try {
   }
 } catch {
   // Audit parse failure is non-fatal for the outdated report
-  console.warn('[check-outdated] Warning: could not parse pnpm audit output; OUTDATED-WITH-ADVISORY cross-check skipped');
+  console.warn(
+    '[check-outdated] Warning: could not parse pnpm audit output; OUTDATED-WITH-ADVISORY cross-check skipped',
+  );
 }
 
 // ── Run pnpm outdated ────────────────────────────────────────────────────────
@@ -123,13 +127,13 @@ for (const [pkgName, info] of Object.entries(outdatedData)) {
   // file header); the authoritative advisory gate is check-audit.mjs.
   if (hasAdvisory) {
     tiers.auditAdvisory.push(entry);
-  // Priority 2: major behind + intentional pin
+    // Priority 2: major behind + intentional pin
   } else if (isMajorBehind && pinReason) {
     tiers.majorBehindIntentional.push({ ...entry, reason: pinReason });
-  // Priority 3: major behind without a pin reason — possible liability
+    // Priority 3: major behind without a pin reason — possible liability
   } else if (isMajorBehind) {
     tiers.majorBehindUnpinned.push(entry);
-  // Priority 4: same major, minor/patch drift
+    // Priority 4: same major, minor/patch drift
   } else {
     tiers.routineDrift.push(entry);
   }
@@ -141,13 +145,19 @@ console.log('=== DEPENDENCY HEALTH REPORT ===');
 console.log('');
 
 // Tier 1: OUTDATED-WITH-ADVISORY (direct deps only — see WR-04 note in header)
-console.log('[OUTDATED-WITH-ADVISORY] Outdated direct deps that also appear as an advisory subject');
-console.log('  (best-effort; most advisories are on transitive deps — authoritative gate is check-audit.mjs):');
+console.log(
+  '[OUTDATED-WITH-ADVISORY] Outdated direct deps that also appear as an advisory subject',
+);
+console.log(
+  '  (best-effort; most advisories are on transitive deps — authoritative gate is check-audit.mjs):',
+);
 if (tiers.auditAdvisory.length === 0) {
   console.log('  (none)');
 } else {
   for (const pkg of tiers.auditAdvisory) {
-    console.log(`  ${pkg.name}  ${pkg.current} → ${pkg.latest}  (${pkg.dependencyType}) *** ADVISORY ON CURRENT VERSION ***`);
+    console.log(
+      `  ${pkg.name}  ${pkg.current} → ${pkg.latest}  (${pkg.dependencyType}) *** ADVISORY ON CURRENT VERSION ***`,
+    );
   }
 }
 console.log('');