web lint hook: a nested lint config a push carries is never used

Merged
LA
3d ago
+79-5

Summary

#34124, which this PR was stacked on, has merged; the PR now targets feat-cmux-next with only its own change.

oxlint loads a nested .oxlintrc.json from any folder it lints, and its jsPlugins run as code. vite-plus 1.3's vp lint ignores a nested one, but plain oxlint loads it. So the pre-push hook's safety depended on how the current tool version looks up its config.

The hook now decides this itself, whatever tool or version runs the lint. These files count as check code wherever they sit in a package or its local build, src/ included, with case and Unicode folded:

  • oxlint and oxfmt rc files and config modules (.oxlintrc*, .oxfmtrc*, oxlint.config.*, oxfmt.config.*);
  • ESLint flat and legacy configs (eslint.config.*, .eslintrc*).

A push that changes one is not linted with that package; CI's web lint job checks it.

It also closes the low finding from #34124's last review: #34060's reviewed-copy path no longer runs when any reason is a symlink. A symlink that a push adds inside scripts/cmux-next/ could make a reviewed check read data outside the tree. It could not run code, but any symlink reason now keeps the reviewed copy out. This has its own red test: b41612fa676 is red on its parent, and the head is green.

The real tree tracks two such files, web/.oxlintrc.json and web/eslint.config.mjs. A push that changes either is not linted locally, which is already true for web/eslint.config.mjs. The last 12 feat-cmux-next commits plan with no refusal.

Testing

Red on 981c9888daa (#34124's earlier head), green on the head:

(cd tests && python3 -m unittest -k nested_lint_config -k config_by_name test_web_lint_prepush)

On the base there are 13 failures: a pushed nested .oxlintrc.json, oxlint.config.ts, .oxfmtrc.json, eslint.config.mjs and .eslintrc.cjs are all linted with. On the head they are refused by name.

Observed / Not run

Observed:

  • python3 tests/test_web_lint_prepush.py: 103 tests OK on this branch (merged with #34124's current head, 2ac4ca7cd33).
  • test_cmux_next_fast_gates: OK.
  • python3 scripts/cmux-next/prepush-gate.py: no new violations.

Not run:

  • Real vp lint or plain oxlint with a pushed nested config. The rule refuses by name, so it does not depend on either tool.

Changelog

none

Proof

No capture: hook tooling only.