chore: switch to oxfmt, oxlint - add ci checks

.github/labeler.yml

@@ -9,4 +9,4 @@
   - any: ["**/*.md"]
 
 "📌 area: ci":
-  - any: [".github/**/*"]
+  - any: [".github/**/*"]

.github/workflows/code-quality.yml

@@ -0,0 +1,38 @@
+name: "🎨 Format & Lint"
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  code-quality:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 20.20.2
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      - name: 💅 Check formatting
+        run: pnpm exec oxfmt --check .
+
+      - name: 🔎 Lint
+        run: pnpm exec oxlint .

.github/workflows/dependabot-critical-alerts.yml

@@ -2,7 +2,7 @@ name: Dependabot Critical Alerts
 
 on:
   schedule:
-    - cron: "0 8 * * *"  # Daily 08:00 UTC
+    - cron: "0 8 * * *" # Daily 08:00 UTC
   workflow_dispatch:
     inputs:
       severity:

.github/workflows/dependabot-weekly-summary.yml

@@ -2,7 +2,7 @@ name: Dependabot Weekly Summary
 
 on:
   schedule:
-    - cron: "0 8 * * 1"  # Mon 08:00 UTC
+    - cron: "0 8 * * 1" # Mon 08:00 UTC
   workflow_dispatch:
 
 # Single-purpose monitoring workflow; serialise on workflow name only - we never
@@ -12,9 +12,9 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: read       # gh CLI baseline
-  pull-requests: read  # gh pr list (open dependabot PRs)
-  actions: read        # gh run list / view (parse latest dependabot run logs)
+  contents: read # gh CLI baseline
+  pull-requests: read # gh pr list (open dependabot PRs)
+  actions: read # gh run list / view (parse latest dependabot run logs)
 
 jobs:
   summary:

.github/workflows/pr_checks.yml

@@ -102,6 +102,11 @@ jobs:
               - 'pnpm-workspace.yaml'
               - 'turbo.json'
 
+  code-quality:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
+    uses: ./.github/workflows/code-quality.yml
+
   typecheck:
     needs: changes
     if: needs.changes.outputs.code == 'true' || needs.changes.outputs.typecheck_self == 'true'
@@ -155,6 +160,7 @@ jobs:
     name: All PR Checks
     needs:
       - changes
+      - code-quality
       - typecheck
       - webapp
       - e2e-webapp

.github/workflows/release-helm.yml

@@ -3,17 +3,17 @@ name: 🧭 Helm Chart Release
 on:
   push:
     tags:
-      - 'helm-v*'
+      - "helm-v*"
   workflow_call:
     inputs:
       chart_version:
-        description: 'Chart version to release'
+        description: "Chart version to release"
         required: true
         type: string
   workflow_dispatch:
     inputs:
       chart_version:
-        description: 'Chart version to release'
+        description: "Chart version to release"
         required: true
         type: string
 
@@ -58,7 +58,7 @@ jobs:
       - name: Validate manifests
         uses: docker://ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
         with:
-          entrypoint: '/kubeconform'
+          entrypoint: "/kubeconform"
           args: "-summary -output json ./helm-output"
 
   release:
@@ -134,7 +134,7 @@ jobs:
         run: |
           VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
           CHART_PACKAGE="/tmp/${{ env.CHART_NAME }}-${VERSION}.tgz"
-          
+
           # Push to GHCR OCI registry
           helm push "$CHART_PACKAGE" "oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts"
         env:
@@ -153,7 +153,7 @@ jobs:
               oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/${{ env.CHART_NAME }} \
               --version "${{ steps.version.outputs.version }}"
             ```
-            
+
             ### Changes
             See commit history for detailed changes in this release.
           files: |

.github/workflows/workflow-checks.yml

@@ -4,14 +4,14 @@ on:
   push:
     branches: [main]
     paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-      - '.github/zizmor.yml'
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
   pull_request:
     paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-      - '.github/zizmor.yml'
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
 
 permissions: {}
 

.github/zizmor.yml

@@ -2,4 +2,4 @@ rules:
   unpinned-uses:
     config:
       policies:
-        '*': hash-pin
+        "*": hash-pin

.oxfmtrc.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "singleQuote": false,
+  "jsxSingleQuote": false,
+  "trailingComma": "es5",
+  "bracketSpacing": true,
+  "bracketSameLine": false,
+  "printWidth": 100,
+  "tabWidth": 2,
+  "useTabs": false,
+  "sortPackageJson": false,
+  "ignorePatterns": [
+    "node_modules",
+    ".env",
+    ".env.local",
+    "pnpm-lock.yaml",
+    "tailwind.css",
+    ".babelrc.json",
+    "**/.react-email/",
+    "**/storybook-static/",
+    "**/.changeset/",
+    "**/dist/",
+    "internal-packages/tsql/src/grammar/",
+    // Maybe turn these on in the future
+    "**/*.yaml",
+    "**/*.mdx",
+    "**/*.md"
+  ]
+}

.oxlintrc.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "import", "react"],
+  "ignorePatterns": [
+    "**/dist/**",
+    "**/build/**",
+    "**/*.d.ts",
+    "**/seed.js",
+    "**/seedCloud.ts",
+    "**/populate.js"
+  ],
+  // All rules below are disabled because they currently fire on the existing
+  // codebase (1748 warnings across these 20 rules as of this commit). Disabled
+  // to keep the lint baseline green; re-enable and fix incrementally.
+  "rules": {
+    // eslint
+    "no-unused-vars": "off",
+    "no-unused-expressions": "off",
+    "no-control-regex": "off",
+    "no-empty-pattern": "off",
+    "no-unused-private-class-members": "off",
+    "no-useless-catch": "off",
+    "no-unsafe-optional-chaining": "off",
+    "no-unreachable": "off",
+    "require-yield": "off",
+    "no-async-promise-executor": "off",
+    "no-unsafe-finally": "off",
+    "no-useless-escape": "off",
+    // typescript
+    "typescript/consistent-type-imports": "off",
+    "typescript/no-this-alias": "off",
+    "typescript/no-non-null-asserted-optional-chain": "off",
+    "typescript/no-unnecessary-parameter-property-assignment": "off",
+    // import
+    "import/no-duplicates": "off",
+    "import/namespace": "off",
+    // react
+    "react/jsx-key": "off",
+    "react/no-children-prop": "off",
+    // react-hooks
+    "react-hooks/exhaustive-deps": "off",
+    // oxlint treats any use*()/use() call as a React hook, producing false
+    // positives in async/test code (testcontainers, cli-v3 e2e).
+    "react-hooks/rules-of-hooks": "off"
+  }
+}

apps/coordinator/package.json

@@ -27,4 +27,4 @@
     "esbuild": "^0.19.11",
     "tsx": "^4.7.0"
   }
-}
+}

apps/docker-provider/package.json

@@ -24,4 +24,4 @@
     "esbuild": "^0.19.11",
     "tsx": "^4.7.0"
   }
-}
+}

apps/kubernetes-provider/package.json

@@ -25,4 +25,4 @@
     "esbuild": "^0.19.11",
     "tsx": "^4.7.0"
   }
-}
+}

apps/supervisor/src/backpressure/k8sPodCountSignalSource.test.ts

@@ -73,9 +73,9 @@ describe("K8sPodCountSignalSource", () => {
       engageThreshold: 10000,
       releaseThreshold: 5000,
     });
-    expect((await source.read()).engaged).toBe(true);  // engage
+    expect((await source.read()).engaged).toBe(true); // engage
     count = 7000;
-    expect((await source.read()).engaged).toBe(true);  // band -> still engaged
+    expect((await source.read()).engaged).toBe(true); // band -> still engaged
     count = 4999;
     expect((await source.read()).engaged).toBe(false); // below release -> off
     count = 7000;

apps/supervisor/src/backpressure/redisBackpressureSignalSource.test.ts

@@ -49,14 +49,17 @@ describe("RedisBackpressureSignalSource", () => {
     }
   });
 
-  redisTest("returns null for valid JSON of the wrong shape (fail-open)", async ({ redisOptions }) => {
-    const redis = new Redis(redisOptions);
-    try {
-      await redis.set(KEY, JSON.stringify({ foo: "bar" }));
-      const source = new RedisBackpressureSignalSource(redis, KEY);
-      expect(await source.read()).toBeNull();
-    } finally {
-      await redis.quit();
+  redisTest(
+    "returns null for valid JSON of the wrong shape (fail-open)",
+    async ({ redisOptions }) => {
+      const redis = new Redis(redisOptions);
+      try {
+        await redis.set(KEY, JSON.stringify({ foo: "bar" }));
+        const source = new RedisBackpressureSignalSource(redis, KEY);
+        expect(await source.read()).toBeNull();
+      } finally {
+        await redis.quit();
+      }
     }
-  });
+  );
 });

apps/supervisor/src/env.ts

@@ -75,9 +75,21 @@ export const Env = z
     TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_TLS_DISABLED: BoolEnv.default(false),
     TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENABLED: BoolEnv.default(false),
     TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_DRY_RUN: BoolEnv.default(true),
-    TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENGAGE: z.coerce.number().int().positive().default(10_000),
-    TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_RELEASE: z.coerce.number().int().positive().default(5_000),
-    TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_REFRESH_MS: z.coerce.number().int().positive().default(5_000),
+    TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENGAGE: z.coerce
+      .number()
+      .int()
+      .positive()
+      .default(10_000),
+    TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_RELEASE: z.coerce
+      .number()
+      .int()
+      .positive()
+      .default(5_000),
+    TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_REFRESH_MS: z.coerce
+      .number()
+      .int()
+      .positive()
+      .default(5_000),
     // Hard timeout on the apiserver /metrics scrape. A hung request would otherwise
     // never settle and freeze the monitor's refresh loop (fail-open silently).
     TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_SCRAPE_TIMEOUT_MS: z.coerce
@@ -350,7 +362,10 @@ export const Env = z
         path: ["TRIGGER_WORKLOAD_API_DOMAIN"],
       });
     }
-    if (data.TRIGGER_DEQUEUE_BACKPRESSURE_ENABLED && !data.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_HOST) {
+    if (
+      data.TRIGGER_DEQUEUE_BACKPRESSURE_ENABLED &&
+      !data.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_HOST
+    ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
         message:

apps/supervisor/src/index.ts

@@ -274,7 +274,10 @@ class ManagedSupervisor {
           rampMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_RAMP_MS,
           dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_DRY_RUN,
           logger: this.logger,
-          metrics: new BackpressureMetrics({ register, prefix: "supervisor_backpressure_pod_count" }),
+          metrics: new BackpressureMetrics({
+            register,
+            prefix: "supervisor_backpressure_pod_count",
+          }),
         })
       );
       this.logger.log("🛑 Dequeue backpressure enabled (pod-count source)", {

apps/supervisor/src/services/computeSnapshotService.test.ts

@@ -10,7 +10,9 @@ const DELAY_MS = 200;
 const SETTLE_MS = 600;
 
 function createService() {
-  const snapshot = vi.fn(async (_opts: { runnerId: string; metadata: Record<string, string> }) => true);
+  const snapshot = vi.fn(
+    async (_opts: { runnerId: string; metadata: Record<string, string> }) => true
+  );
 
   const computeManager = {
     snapshotDelayMs: DELAY_MS,
@@ -97,9 +99,7 @@ describe("ComputeSnapshotService", () => {
       expect(service.cancel("run_1", "runner-b")).toBe(false);
 
       await vi.waitFor(() => expect(snapshot).toHaveBeenCalledTimes(1), { timeout: 2_000 });
-      expect(snapshot).toHaveBeenCalledWith(
-        expect.objectContaining({ runnerId: "runner-a" })
-      );
+      expect(snapshot).toHaveBeenCalledWith(expect.objectContaining({ runnerId: "runner-a" }));
     } finally {
       service.stop();
     }