diff --git a/.github/linters/.yaml-lint.yml b/.github/linters/.yaml-lint.yml index 1fb6ff1a09b..a57c171b199 100644 --- a/.github/linters/.yaml-lint.yml +++ b/.github/linters/.yaml-lint.yml @@ -4,6 +4,8 @@ extends: default rules: brackets: max-spaces-inside: 1 + comments: + min-spaces-from-content: 1 comments-indentation: disable document-start: disable line-length: disable diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index eecbb919659..bbd9b7170bb 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -21,4 +21,4 @@ - [ ] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [ ] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [ ] I've updated the documentation accordingly. -- [ ] I ran `make lint && make type-check` (backend) and `cd web && pnpm exec vp staged` (frontend) to appease the lint gods +- [ ] I ran `make lint && make type-check` (backend) and `vp staged` (frontend) to appease the lint gods diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml index 6b3f297f482..005326a6380 100644 --- a/.github/workflows/autofix.yml +++ b/.github/workflows/autofix.yml @@ -50,6 +50,8 @@ jobs: vite.config.ts lint.config.ts eslint.config.mjs + knip.config.ts + scripts/check-web-production-unused-after-knip-fix.mjs oxlint-suppressions.json eslint-suppressions.json .vscode/** diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml index c0a8fe7ca3c..843bc9a0e13 100644 --- a/.github/workflows/style.yml +++ b/.github/workflows/style.yml @@ -174,6 +174,8 @@ jobs: vite.config.ts lint.config.ts eslint.config.mjs + knip.config.ts + scripts/check-web-production-unused-after-knip-fix.mjs oxlint-suppressions.json eslint-suppressions.json .vscode/** @@ -210,6 +212,7 @@ jobs: **Dockerfile dev/** .editorconfig + .vite-hooks/** - name: Super-linter uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0 @@ -218,10 +221,11 @@ jobs: BASH_SEVERITY: warning DEFAULT_BRANCH: origin/main EDITORCONFIG_FILE_NAME: editorconfig-checker.json - FILTER_REGEX_INCLUDE: pnpm-lock.yaml + ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} IGNORE_GENERATED_FILES: true IGNORE_GITIGNORED_FILES: true + VALIDATE_ALL_CODEBASE: false VALIDATE_BASH: true VALIDATE_BASH_EXEC: true # FIXME: temporarily disabled until api-docker.yaml's run script is fixed for shellcheck diff --git a/.vite-hooks/pre-commit b/.vite-hooks/pre-commit index d48381bce26..9de19c91ef8 100755 --- a/.vite-hooks/pre-commit +++ b/.vite-hooks/pre-commit @@ -5,7 +5,6 @@ files=$(git diff --cached --name-only) # check if api or web directory is modified api_modified=false -web_modified=false skip_web_checks=false git_path() { @@ -29,10 +28,6 @@ do # set api_modified flag to true api_modified=true ;; - web/*) - # set web_modified flag to true - web_modified=true - ;; esac done diff --git a/RESOURCE_BOUNDARY_CHANGE_GUIDE.md b/RESOURCE_BOUNDARY_CHANGE_GUIDE.md deleted file mode 100644 index b22386f8e5b..00000000000 --- a/RESOURCE_BOUNDARY_CHANGE_GUIDE.md +++ /dev/null @@ -1,12 +0,0 @@ -# Resource Boundary Change Guide - -- Resolve the tenant-scoped parent at the request boundary, then pass the validated model, owner reference, and actor downstream. -- Put the complete owner tuple in the database query; do not load by a bare ID and check ownership afterward. -- Treat missing and foreign-owned resources alike as `404` before locks, rate limits, tasks, plugin calls, network calls, or writes. -- Reuse existing owner resolvers and trusted objects instead of adding parallel helpers or refetching the same resource. -- Pass tenant, actor, and session explicitly; authenticated code must not depend on ambient account or tenant fallbacks. -- Raise typed domain errors in services and translate them to HTTP errors in controllers; reserve `ValueError` for invalid values or state. -- Let RBAC own authorization when enabled, and run legacy dataset permission checks only when RBAC is disabled. -- Preserve successful HTTP responses and shared runtime contracts, especially Celery task names and argument shapes during rolling upgrades. -- Keep runtime validation and OpenAPI schemas aligned, then regenerate Markdown and TypeScript contracts after schema changes. -- Prove the boundary with a foreign-owner decoy and assert that rejected requests trigger no downstream side effects. diff --git a/lint.config.ts b/lint.config.ts index b48bec470cc..6e045c39247 100644 --- a/lint.config.ts +++ b/lint.config.ts @@ -138,7 +138,8 @@ export const lintConfig = { 'dify-agent/**', 'docker/**', 'docs/**', - 'scripts/**', + 'scripts/**/*', + '!scripts/check-web-production-unused-after-knip-fix.mjs', 'sdks/php-client/**', 'sdks/python-client/**', '**/.next/**', diff --git a/vite.config.ts b/vite.config.ts index 2ca40cf7f6b..3f97680d425 100644 --- a/vite.config.ts +++ b/vite.config.ts @@ -5,6 +5,7 @@ const lintFiles = '*.{js,cjs,mjs,jsx,ts,cts,mts,tsx}' const eslintFiles = '*.{json,jsonc,json5,md,yml,yaml,toml}' const formatOnlyFiles = '*.{mdx,css,scss,less,html,vue,svelte,gql,graphql,hbs,handlebars}' const checkFix = 'vp check --fix --no-error-on-unmatched-pattern' +const formatFix = 'vp fmt --no-error-on-unmatched-pattern' const eslintFix = 'eslint --fix --pass-on-unpruned-suppressions --no-error-on-unmatched-pattern --no-warn-ignored' @@ -18,7 +19,8 @@ const nonFrontendIgnores = [ 'dify-agent/**', 'docker/**', 'docs/**', - 'scripts/**', + 'scripts/**/*', + '!scripts/check-web-production-unused-after-knip-fix.mjs', 'sdks/php-client/**', 'sdks/python-client/**', ] @@ -46,8 +48,9 @@ export default defineConfig({ lint: lintConfig, staged: { [lintFiles]: checkFix, - [eslintFiles]: [eslintFix, checkFix], - [formatOnlyFiles]: checkFix, + [eslintFiles]: [eslintFix, formatFix], + [formatOnlyFiles]: formatFix, + '.vite-hooks/*': 'sh -n', }, fmt: { ignorePatterns: [...nonFrontendIgnores, ...generatedIgnores, ...formatterUnstableInputs],