DeepSource, Codacy and more lints

.codacy.yaml

@@ -0,0 +1,11 @@
+# Codacy's in-repo config can only exclude paths -- it cannot disable individual patterns (dashboard-only).
+# These paths carry findings the repo already covers elsewhere or has consciously decided against:
+# - config/semgrep/: our Semgrep rule files; Codacy's own Semgrep misfires on the `- id:` each rule declares.
+# - Dockerfile: Codacy's default hadolint re-flags DL4006 (curl | sh pipefail), which config/hadolint.yaml
+#   deliberately ignores and the repo's own hadolint-check + DeepSource Docker already cover.
+# - dotnet-data1/Program.cs: Codacy's CA1054 wants URI-typed params, but [JSImport] partial methods can only
+#   marshal `string` across the JS boundary; DeepSource covers the C# there and reports no such issue.
+exclude_paths:
+  - "Dockerfile"
+  - "config/semgrep/**"
+  - "services/ws-modules/dotnet-data1/Program.cs"

.deepsource.toml

@@ -0,0 +1,38 @@
+version = 1
+
+# Trees that are generated or vendored rather than hand-written source.
+# Built module artifacts under any `pkg/`, the int-gen outputs under `generated/`, and the scenario `verification/`
+# fixtures. The mingw-shim is MSVC-CRT ABI glue (non-const ABI symbols like `__security_cookie`, lazy-init `static`
+# function-pointer caches, naked asm) where the general C best-practice rules only ever produce false positives;
+# clang-tidy/cpplint already cover that tree.
+exclude_patterns = ["**/pkg/**", "generated/**", "services/ws-web-runner/mingw-shim/**", "verification/**"]
+
+# Repo convention: tests live in a `tests/` directory or in source files prefixed `test_`.
+test_patterns = ["**/test_*.py", "**/tests/**"]
+
+[[analyzers]]
+enabled = true
+name = "python"
+
+[[analyzers]]
+enabled = true
+name = "javascript"
+
+[analyzers.meta]
+# The browser modules and the ws-server `static/app.js` are ES modules (top-level `import`/`export`).
+# Without an es-modules parser the analyzer treats them as scripts and reports spurious JS-0833 errors
+# ("'import'/'export' may appear only with 'sourceType: module'").
+environment = ["browser", "nodejs"]
+module_system = "es-modules"
+
+[[analyzers]]
+enabled = true
+name = "csharp"
+
+[[analyzers]]
+enabled = true
+name = "docker"
+
+[[analyzers]]
+enabled = true
+name = "cxx"

.github/actions/free-disk-space-windows/action.yaml

@@ -108,7 +108,24 @@ runs:
       shell: bash --noprofile --norc -euo pipefail {0}
       env:
         KEEP_IMAGE: ${{ inputs.keep-image }}
+      # Start the Docker daemon first so the prune actually reclaims image space instead of skipping it.
+      # Skipping would leave several GB of preinstalled Windows base images consumed, which can starve a later
+      # step of disk. Hosted Windows runners don't reliably leave the daemon running (docker-windows.yaml starts
+      # it the same way), so start the service if `docker info` can't reach it, then wait for readiness. Only if
+      # it still can't come up do we skip (best-effort) rather than fail the whole disk-free step.
       run: |
+        if ! docker info >/dev/null 2>&1; then
+          echo "docker daemon not running; starting the docker service"
+          sc query docker | grep -q RUNNING || net start docker || true
+          for _ in 1 2 3 4 5 6 7 8 9 10; do
+            docker info >/dev/null 2>&1 && break
+            sleep 3
+          done
+        fi
+        if ! docker info >/dev/null 2>&1; then
+          echo "docker daemon still unavailable after start attempt; skipping image/builder prune"
+          exit 0
+        fi
         docker images
         for img in $(docker images --format '{{.Repository}}:{{.Tag}}'); do
           if [ "$img" != "$KEEP_IMAGE" ]; then

.github/actions/install-mise/action.yaml

@@ -22,7 +22,7 @@ runs:
     - name: Install mise
       uses: taiki-e/install-action@v2
       with:
-        tool: cargo-binstall,mise@2026.6.5
+        tool: cargo-binstall,mise@2026.7.1
 
     - name: Install extra tools via install-action
       if: inputs.install-action-tools != ''

.github/workflows/check.yaml

@@ -34,7 +34,7 @@ jobs:
           - os: macos-latest
             timeout: 45
           - os: windows-latest
-            timeout: 75
+            timeout: 120
     # Windows runs the checkers under busybox-w32 ash, same as test.yaml's Windows lane.
     # That's the shell mise's `shell = "bash"` tasks run on; Git Bash's MSYS fork-emulation cygheap breaks
     # down on long task chains. The path matches the version pin in `.mise/config.windows.toml`'s
@@ -56,9 +56,12 @@ jobs:
         if: runner.os == 'Windows'
         uses: ./.github/actions/free-disk-space-windows
 
+      # Windows tools source-build under mise 2026.7.1, so this step runs long (bumped from 25).
+      # The per-tool msvc `install_env` override no longer reaches cargo-binstall there, so cargo tools like
+      # action-validator compile from source instead of fetching their msvc prebuilts. Revert once mise fixes it.
       - name: Install mise + tools
         uses: ./.github/actions/install-mise-tools
-        timeout-minutes: 25
+        timeout-minutes: 60
         with:
           github-token: ${{ github.token }}
 

.github/workflows/docker-windows.yaml

@@ -48,9 +48,9 @@ jobs:
     env:
       # Pin the mise version because the prebuilt "latest" zip is too old.
       # The classic Windows builder on windows-2022 can't substitute build-args into the Dockerfile's RUN, and
-      # mise's prebuilt "latest" zip is stale (2026.3.0, too old for the config). 2026.6.5 is the first release
-      # with auto_env (loads .mise/config.windows.toml).
-      MISE_VERSION: "2026.6.5"
+      # mise's prebuilt "latest" zip is stale (2026.3.0, too old for the config). 2026.7.1 is required: the config
+      # templates use Tera v2 syntax, which mise switched to in 2026.7.1 (older mise fails to parse them).
+      MISE_VERSION: "2026.7.1"
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/test.yaml

@@ -70,22 +70,22 @@ jobs:
           '{"os":"ubuntu-24.04-arm","timeout":40}',
           '{"os":"macos-latest","timeout":45}',
           '{"os":"macos-26-intel","timeout":60}',
-          '{"os":"windows-latest","timeout":60}',
+          '{"os":"windows-latest","timeout":120}',
           '{"os":"windows-11-arm","timeout":60}'
           )
           || github.event.inputs.os == 'ubuntu-latest' && '[{"os":"ubuntu-latest","timeout":40}]'
           || github.event.inputs.os == 'ubuntu-26.04' && '[{"os":"ubuntu-26.04","timeout":40}]'
           || github.event.inputs.os == 'ubuntu-24.04-arm' && '[{"os":"ubuntu-24.04-arm","timeout":40}]'
           || github.event.inputs.os == 'macos-latest' && '[{"os":"macos-latest","timeout":45}]'
           || github.event.inputs.os == 'macos-26-intel' && '[{"os":"macos-26-intel","timeout":60}]'
-          || github.event.inputs.os == 'windows-latest' && '[{"os":"windows-latest","timeout":60}]'
+          || github.event.inputs.os == 'windows-latest' && '[{"os":"windows-latest","timeout":120}]'
           || github.event.inputs.os == 'windows-11-arm' && '[{"os":"windows-11-arm","timeout":60}]'
           )
           || format('[{0},{1},{2},{3}]',
           '{"os":"ubuntu-latest","timeout":40}',
           '{"os":"ubuntu-24.04-arm","timeout":40}',
           '{"os":"macos-latest","timeout":45}',
-          '{"os":"windows-latest","timeout":60}')
+          '{"os":"windows-latest","timeout":120}')
           ) }}
     steps:
       - name: Checkout
@@ -108,9 +108,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends mesa-vulkan-drivers
 
+      # Windows tools source-build under mise 2026.7.1, so this step runs long (bumped from 20).
+      # The per-tool msvc `install_env` override no longer reaches cargo-binstall there, so cargo tools like
+      # action-validator compile from source instead of fetching their msvc prebuilts. Revert once mise fixes it.
       - name: Install mise + tools
         uses: ./.github/actions/install-mise-tools
-        timeout-minutes: 20
+        timeout-minutes: 60
         with:
           github-token: ${{ github.token }}
 
@@ -150,7 +153,7 @@ jobs:
   # the `default` job because they override the gnullvm default target rather than exercising it.
   override:
     runs-on: windows-latest
-    timeout-minutes: 90
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -176,9 +179,12 @@ jobs:
       - name: Free disk space on Windows
         uses: ./.github/actions/free-disk-space-windows
 
+      # Windows tools source-build under mise 2026.7.1, so this step runs long (bumped from 25).
+      # The per-tool msvc `install_env` override no longer reaches cargo-binstall there, so cargo tools like
+      # action-validator compile from source instead of fetching their msvc prebuilts. Revert once mise fixes it.
       - name: Install mise + tools
         uses: ./.github/actions/install-mise-tools
-        timeout-minutes: 25
+        timeout-minutes: 60
         with:
           github-token: ${{ github.token }}
 

.mise/config.java.toml

@@ -18,15 +18,15 @@ maven = "3.9.16"
 # Windows-only slash normalization: %LOCALAPPDATA% arrives in mise's tera context with forward slashes
 # (`C:/Users/.../AppData/Local`) but our literal segments use backslashes; the resulting mixed-slash path
 # passes busybox `ls` but mvn.cmd's `if not exist "%JAVA_HOME%\bin\java.exe"` rejects it. The
-# `| replace(from="/", to=`\`)` pass on the prefix normalizes everything to a single backslash. Note the
-# backtick-quoted string for the replacement: tera 1.20's pest grammar treats strings verbatim (no `\\`-as-`\`
-# escape), so backticks + a single literal backslash are the way to express a one-char `\` argument.
+# `| replace(from="/", to="\\")` pass on the prefix normalizes everything to a single backslash. Note the
+# `"\\"` escape: Tera v2 (mise 2026.7.1+) parses C-style backslash escapes in double-quoted strings, so `"\\"`
+# is one literal `\`. (Tera v1 had no escapes and needed a backtick raw-string; Tera v2 dropped backtick strings.)
 java_home = '''{% if os() == "windows" -%}
-{%- set win_base = get_env(name="LOCALAPPDATA", default="") ~ "\mise" -%}
-{{- get_env(name="MISE_DATA_DIR", default=win_base) | replace(from="/", to=`\`) -}}
+{%- set win_base = (env?.LOCALAPPDATA or "") ~ "\\mise" -%}
+{{- (env?.MISE_DATA_DIR or win_base) | replace(from="/", to="\\") -}}
 \installs\java\26.0.1
 {%- else -%}
-{{- get_env(name="MISE_DATA_DIR", default=env.HOME ~ "/.local/share/mise") -}}
+{{- env?.MISE_DATA_DIR or (env.HOME ~ "/.local/share/mise") -}}
 /installs/java/26.0.1
 {%- endif %}'''
 

.mise/config.js.toml

@@ -9,6 +9,11 @@
 
 [tools]
 "npm:onnxruntime-web" = "latest"
+# oxlint-tsgolint is oxlint's type-aware engine.
+# It's a typescript-go type checker oxlint shells out to under `--type-aware`. npm-only: it ships no GitHub
+# release assets, distributing per-platform binaries via `@oxlint-tsgolint/<triple>` optional deps, so every OS
+# is covered without os-scoping.
+"npm:oxlint-tsgolint" = "0.24.0"
 "npm:pnpm" = { version = "latest", os = ["macos/x64"] }
 
 # oxlint + oxfmt are the Rust-native JS/TS linter + formatter from the oxc-project.
@@ -20,7 +25,7 @@
 [tools."http:oxlint"]
 bin = "oxlint"
 rename_exe = "oxlint"
-version = "1.69.0"
+version = "1.73.0"
 [tools."http:oxlint".platforms.linux-arm64]
 url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxlint-aarch64-unknown-linux-gnu.tar.gz"
 [tools."http:oxlint".platforms.linux-x64]
@@ -32,10 +37,11 @@ url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/ox
 [tools."http:oxlint".platforms.windows-x64]
 url = "https://github.com/oxc-project/oxc/releases/download/apps_v{{version}}/oxlint-x86_64-pc-windows-msvc.zip"
 
-# oxfmt's binary version lags oxlint's.
-# They ship from the same apps_v tag but track separate semver. Pin the URL to the release tag that bundles
-# both (`apps_v<oxlint_ver>` -- here apps_v1.69.0); bump that string when
-# bumping oxlint above.
+# oxfmt is pinned independently of oxlint.
+# Both ship from per-version `apps_v` tags but track separate semver. oxfmt stays on apps_v1.69.0 / 0.54.0: its
+# output is tuned against dprint (config/oxfmtrc.jsonc + config/dprint.jsonc) at that version, and a bump risks
+# reformatting churn that fights dprint. oxlint above rode ahead to 1.73.0 for the `--type-aware` engine. Re-pin
+# oxfmt here only after re-validating the oxfmt <-> dprint agreement at the new version.
 [tools."http:oxfmt"]
 bin = "oxfmt"
 rename_exe = "oxfmt"
@@ -72,12 +78,14 @@ description = "Lint JavaScript/TypeScript sources (oxlint)"
 # oxlint walks the working tree from CWD, honouring .gitignore; no path arg needed.
 # Errors fail the task (correctness category, lifted in oxlintrc); warnings print but don't fail -- the initial
 # introduction kept stylistic warnings visible rather than blocking on the existing module shims' style. Tighten
-# with `--deny-warnings` once those are cleaned up.
-run = "oxlint --config config/oxlintrc.jsonc"
+# with `--deny-warnings` once those are cleaned up. `--type-aware` (backed by the oxlint-tsgolint tool +
+# config/tsconfig.json) enables the type-aware rule set; without it typescript/prefer-optional-chain silently
+# no-ops.
+run = "oxlint --config config/oxlintrc.jsonc --type-aware --tsconfig config/tsconfig.json"
 
 [tasks.oxlint-fix]
 description = "Auto-fix oxlint violations that have a machine-applicable suggestion"
-run = "oxlint --config config/oxlintrc.jsonc --fix"
+run = "oxlint --config config/oxlintrc.jsonc --type-aware --tsconfig config/tsconfig.json --fix"
 
 [tasks.oxfmt-check]
 description = "Check JS/TS formatting (oxfmt)"

.mise/config.mingw.toml

@@ -74,7 +74,7 @@ win_gcc_bin = '{{ vars.mise_installs }}\github-brechtsanders-winlibs-mingw\16.1.
 # autotools trees (libffi-sys) splice $CC into sh/libtool command lines, where backslashes are eaten
 # ("C:Users...gcc.exe: command not found"); Windows APIs accept forward slashes, so this form works for
 # cargo and sh alike.
-win_gcc_bin_fwd = "{{ vars.win_gcc_bin | replace(from='\\', to='/') }}"
+win_gcc_bin_fwd = '{{ vars.win_gcc_bin | replace(from="\\", to="/") }}'
 
 [env]
 # cc-rs (build scripts compiling bundled C) resolves the target compiler from these before probing PATH.

.mise/config.python.toml

@@ -6,6 +6,7 @@
 "pipx:componentize-py" = "latest"
 "pipx:datamodel-code-generator" = { version = "latest", extras = "ruff" }
 "pipx:openapi-python-client" = "0.29.0"
+"pipx:pyrefly" = "latest"
 "pipx:pytest" = "latest"
 # PyTorch, for the et-ws-pyo3-runner `torch_inference` test.
 # Python-only (not in the always-loaded config) -- it's a large optional dependency, and the test skips itself
@@ -39,6 +40,7 @@ RUFF_CACHE_DIR = "{{ config_root }}/target/ruff-cache"
 # It honours .gitignore (so target/ is skipped) and ruff.toml's `exclude`/`extend-exclude`. Every tracked *.py
 # already lives under a dir we want linted, so discovery covers them without an explicit include list -- scope
 # is narrowed by excludes only.
+pyrefly-check = "pyrefly check -c config/pyrefly.toml"
 ruff-check = "ruff check"
 ruff-fix = "ruff check --fix"
 ruff-fmt = "ruff format"
@@ -47,8 +49,8 @@ ruff-fmt-check = "ruff format --check"
 # Namespaced aggregators picked up by the default config's globbed tasks.
 # Those are its `check`/`fmt`/`test`.
 [tasks."check:python"]
-depends = ["ruff-check", "ruff-fmt-check"]
-description = "Run Python checks (ruff lint + format-check)"
+depends = ["pyrefly-check", "ruff-check", "ruff-fmt-check"]
+description = "Run Python checks (ruff lint + format-check, Pyrefly type-check)"
 
 [tasks."fmt:python"]
 depends = ["ruff-fmt"]

.mise/config.toml

@@ -11,7 +11,7 @@
 #   Make a selection sticky:            export MISE_ENV=dart
 
 # Require release that introduced auto_env enabled in .miserc.toml
-min_version = "2026.6.5"
+min_version = "2026.7.1"
 
 [settings]
 # Disable mise's two auto-install paths so tasks fail fast on a missing tool.
@@ -246,7 +246,7 @@ a_rp_release = "rp-v1"
 # erroring: every var built from it (mise_data_dir, conda_openssl, py3_unix, pylib_flag, ort_loc_unix) is Unix-only
 # and unused on Windows, where mise uses %LOCALAPPDATA%\mise and config.windows.toml supplies the real paths.
 a_home = '''{% if os() == "windows" -%}
-{{- get_env(name="USERPROFILE", default="") | replace(from=`\`, to="/") -}}
+{{- (env?.USERPROFILE or "") | replace(from="\\", to="/") -}}
 {%- else -%}
 {{- env.HOME -}}
 {%- endif %}'''
@@ -262,7 +262,7 @@ augeas_windows_x64_asset = "1.14.1-x86_64-pc-windows-mingw.tar.gz"
 # mise data dir -- the parent of `installs/<backend>-<name>/<version>`.
 # Used to compose absolute paths into a tool's install dir from [env] (e.g. AUGEAS_LENS_LIB). Honours
 # MISE_DATA_DIR if set; otherwise mise's default of $XDG_DATA_HOME (~/.local/share/mise on Linux/macOS).
-mise_data_dir = '{{ get_env(name="MISE_DATA_DIR", default=vars.a_home ~ "/.local/share/mise") }}'
+mise_data_dir = '{{ env?.MISE_DATA_DIR or (vars.a_home ~ "/.local/share/mise") }}'
 # clang-tidy's resource-dir arg (points clang at its builtin headers, e.g.
 # stddef.h). Empty default; config.linux.toml sets it from conda:clangxx.
 clang_resource_arg = ""
@@ -272,7 +272,7 @@ conda_openssl = "{{ vars.a_home }}/.local/share/mise/installs/conda-openssl/3"
 # command line trips `\a` -> alert, `\c` -> "suppress output" string mangling inside busybox ash, so paths
 # like `D:\a\core\core/target/...` become `D:acorecore/target/...`). Forward slashes Just Work on both
 # shells. Used as the root of every workspace-relative var below.
-config_root_fwd = "{{ config_root | replace(from='\\', to='/') }}"
+config_root_fwd = '{{ config_root | replace(from="\\", to="/") }}'
 # Absolute path to the workspace-built et-cli binary.
 # The parallel build-ws-*-module tasks each invoke `et-cli module-package-json`; using this var (rather than
 # `cargo run -p et-cli`) means every invocation execs the same pre-built binary instead of re-entering cargo,
@@ -359,7 +359,7 @@ a_rp_wasm_short = "08a1d6f"
 # normalizer (`cp: The system cannot find the path specified. (os error 3)`).
 gh_http = "--http-url https://github.com --progress --ignore-existing"
 rp_wasm_dir = '''{% if os() == "windows" -%}
-{%- set base = get_env(name="LOCALAPPDATA", default="") | replace(from=`\`, to="/") -%}
+{%- set base = (env?.LOCALAPPDATA or "") | replace(from="\\", to="/") -%}
 {{- base -}}/mise/installs/http-rp-wasm/{{- vars.a_rp_wasm_short -}}
 {%- else -%}
 {{- vars.mise_data_dir -}}/installs/http-rp-wasm/{{- vars.a_rp_wasm_short -}}