Skip to content

fix(config): align pnpm v11 config, canonical hooks, fix scripts#63

Merged
John-David Dalton (jdalton) merged 5 commits intomainfrom
fix/pnpm-workspace-config
Apr 14, 2026
Merged

fix(config): align pnpm v11 config, canonical hooks, fix scripts#63
John-David Dalton (jdalton) merged 5 commits intomainfrom
fix/pnpm-workspace-config

Conversation

@jdalton
Copy link
Copy Markdown
Collaborator

Summary

  • Remove invalid pnpm settings (ignoreDependencyScripts, linkWorkspacePackages)
  • Add trustPolicy to pnpm-workspace.yaml
  • Canonical pre-push hook with remote/main range logic (no false positives)
  • Thin husky wrappers, remove orphaned security-checks.sh
  • Add zizmor + agentshield --fix to pnpm run fix
  • Fix AgentShield false positive in agent files

Test plan

  • pnpm install works locally
  • Pre-push hook validates correctly on new branches
  • CI passes

Run security tools with auto-fix after lint:
- zizmor --fix .github/ (if .github/ exists)
- agentshield scan --fix (if .claude/ and agentshield exist)

Both are non-blocking — unfixable findings log warnings but don't
fail the overall fix run. Tools that aren't installed are skipped.
- .git-hooks/pre-push: replace release-tag baseline with remote/main
  for new branches (prevents false positives from re-scanning merged history)
- .husky/pre-push: simplify to thin 2-line wrapper
- .husky/security-checks.sh: remove if orphaned
Rephrase "Backward Compatibility" → "Compat shims" in agent files.
AgentShield's pattern matcher flags "Backward" as an encoded payload
false positive. The rule itself (FORBIDDEN, actively remove) is
unchanged and already in CLAUDE.md.
Replace manual Promise + child_process pattern with async spawn.
Replace console.error/warn with logger from @socketsecurity/lib/logger
(or lib-stable for socket-lib) for consistent output formatting.
@jdalton John-David Dalton (jdalton) merged commit 72f0529 into main Apr 14, 2026
8 checks passed
@jdalton John-David Dalton (jdalton) deleted the fix/pnpm-workspace-config branch April 14, 2026 15:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant