ci: enforce JavaScript and PowerShell language quality gates #7
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/AppKit#7
Reference in new issue
Block a user
Problem
Coverage PowerShell scripts lack shared analyzer configuration and CI enforcement. Proposed review JavaScript has Node tests but lacks ESLint and javascript-typescript CodeQL coverage.
Acceptance criteria
Configure applicable shared lint rules and required CI gates; fix findings without blanket suppressions; preserve meaningful review-gate and coverage regression tests; include JavaScript in CodeQL.
Scope
AppKit; propagate PowerShell controls to starter.
This issue is part of the user-requested AppKit readiness remediation. Local work is not completion until the applicable published/runtime state and checks are verified. Substantial AI assistance: Codex.
Implemented local JavaScript ESLint using shared Kingsrook rules, seven native Node regression tests, exact development-tool versions and package lock, disabled lifecycle scripts, and npm signature verification (83 registry signatures / 20 attestations verified). Added javascript-typescript CodeQL. Shared PowerShell analyzer settings and pinned 1.25.0 CI gates added in both repositories; coverage scripts formatted, use StrictMode, and pass analysis plus real 100% coverage reports. Workflow lint passes. Live CodeQL/required-check rollout remains.
Language tooling changes committed locally in AppKit
36886cbaae8810bf9c9a3c85867a2cee51d0ba3dand windows-app-templatea5cbc98cd72e7223a0f61c5c4a237afc0de60efe.ESLint and seven native Node tests pass. npm verification passed for 83 registry signatures and 20 attestations; npm audit reported zero vulnerabilities. Shared PowerShell rules pass in both repositories, with four Pester coverage-gate regression tests per repo (eight combined). JavaScript/TypeScript CodeQL selection is added to AppKit. Script workflows also gate releases.
Remaining: live Actions and CodeQL verification after publication. Signed commits remain local. AI assistance: Codex (GPT-6).
The PowerShell correction at
09f9e07is verified on GitHub: run 38093180400 succeeds, including all 40 Pester cases (zero failed/skipped) and unchanged full-rule file-by-file analysis. JavaScript lint/tests/package-signature verification also succeeds.The remaining dependency-review failure requires policy review. A separate local standards branch docs/appkit-tooling-license has signed/DCO commit cd20e945bd9809745d4d872ae29dd2496b5a9644, proposing EX-0009 only for development-only uri-js 4.4.1 in AppKit. One-file review, Markdown and applicable hooks pass. It is unpushed; proposal status and caller gate stay unchanged until reviewed approval through the published process. Nothing exempts vulnerability checks or other licenses.
This is additional to the two authorized draft PRs; a third push/draft PR needs separate authorization. #26 remains open for license-policy and exact-head acceptance; #7 remains open for required-context activation and starter hosted propagation.
Final hosted checkpoint:
09f9e0777e: build-test, format, WinUI/WPF UI, PowerShell (40/40), JavaScript/review tests, title/DCO, security and all three CodeQL language checks succeed. CodeQL run 38093181044 is completed SUCCESS. The only failed check is dependency-review's uri-js tooling-license policy rejection.No CI job is still pending. License-policy acceptance remains unresolved: EX-0009 is Proposed, not Open/approved, and no caller exemption is enabled. Both the exact-version exception and any eventual caller correction need the normal reviewed process and updated current-head acknowledgement. No gate was weakened to obtain these results.
All three branches were pushed with explicit approval and remain drafts. No merge, release, starter creation/push, settings or Azure mutation/login retry occurred. Hosted results do not prove actual AppKit Azure signing, production feeds or full standards compliance. Scoped implementation/tests are verified; broader acceptance tickets remain open.
Committed starter d8cea35cdf971ae327d69adc7ab222a1e7d891e3 (signed/DCO): the bootstrap plan now requires GitHub's actual standalone job names installed-updates, powershell and javascript; the template source additionally requires template. Generated apps omit that source-only packaging gate.
A new regression reads standalone job names from the actual ci.yml/scripts.yml workflows. It failed against the old plan (13 passed, one failed), then passed after correction. The source and both renamed, custom-owner variants generated from the real packed template each pass all 41 script tests. No manual synchronization of generated files. Source/generated workflow syntax and offline security, docs, Node seven-case review tests/ESLint and applicable commit hooks pass. Generated policies contain 16 actual contexts; source has 17.
Propagated AppKit's full-rule file-by-file analyzer workflow. Individual source/generated checks pass, but the pinned analyzer still occasionally crashes internally before emitting findings; file-by-file execution is not a proven complete cure. No rule/error suppression or retry wrapper is added. #26 remains open for that tool stability and license acceptance. Earlier complete installed runtime evidence covers unchanged UI/application code; this commit changes only administration/tests/docs and the analysis job.
Live disposable-repository setup and hosted starter gates still require public rollout/settings authorization. #10 remains open against that deployed acceptance requirement. Original sibling checkout is preserved; starter topic branch has no origin and has not been pushed.