Clear GitRoll reliability findings and add type-aware lint - #23

GitRoll reliability findings

I fetched the scanner's client-side issues endpoint (/api/repo-scan/0XzG8rAOs9WUp2BJ5h9t/issues?p=1&ps=100) and read all 42 returned issues. The seven BUGs are:

All seven are cleared in the source: no finding was left unresolved. The three duplicate CSS selector smells were also consolidated while touching that stylesheet.

Finding inventory

Location split:

• Bugs: web/ 7, scripts/ 0, content//cv//other 0.
• Smells: web/ 24, scripts/ 11, content//cv//other 0.

Message-grouped smell breakdown (35 total):

• “Refactor this code to not use nested template literals.” — 7: scripts/build-cv-data.mjs (341, 344, 345), scripts/check-deployment-base.mjs:63, web/src/lib/announcements.ts (280, 349, 626).
• “Refactor this function to reduce its Cognitive Complexity …” — 7: scripts/build-cv-data.mjs (385, 554), web/src/lib/announcements.ts:351, web/src/lib/consistency.ts:363, web/src/lib/cv-schema.ts:479, web/src/lib/record.ts (319, 528).
• “Extract this nested ternary operation into an independent statement.” — 8: scripts/build-cv-data.mjs:398, scripts/import-orcid.mjs:85, scripts/read-cv-owner.mjs:16, web/src/lib/cv-schema.ts (268, 270, 272), web/src/lib/record.ts (415, 431).
• “Extract the assignment of match from this expression.” — 1: scripts/build-cv-data.mjs:390.
• “This loop's stop condition tests match, directive, source but the incrementer updates directive.lastIndex.” — 1: scripts/build-cv-data.mjs:390.
• “This assertion is unnecessary …” — 3: web/src/lib/consistency.ts:412, web/src/lib/urls.ts:45, web/src/pages/rss.xml.ts:28.
• “Remove this assignment of cursor.” — 1: web/src/lib/record.ts:345.
• “Remove duplicates in this character class.” — 4: web/src/lib/record.ts (719 twice, 728 twice).
• “Unexpected duplicate selector …” — 3: web/src/styles/global.css (103, 865, 1478).

Type-aware lint

Added explicit root dev dependencies (eslint 9.39.5 and typescript-eslint 8.46.0), a flat config using web/tsconfig.json in project/type-aware mode, and the two focused rules used by the reference implementation. The lint workflow installs both npm lockfiles and runs beside the existing checks. No formatter was added.

Cold-install evidence (actual output):

$ npm ci
added 127 packages, and audited 128 packages in 7s
found 0 vulnerabilities
$ npm ci --prefix web
added 425 packages, and audited 426 packages in 6s
3 high severity vulnerabilities
$ npm run lint
> ledgerpress@1.0.0 lint
> eslint web

The web audit warning is from the existing web dependency tree; lint exits 0 and the GitRoll scan reported Security A / 0 vulnerabilities.

Validation

$ npm run check
Regenerating cv/generated/cv-data.tex from content/cv.yaml — this check writes that tracked file.
wrote cv/generated/cv-data.tex
cv/generated/cv-data.tex is up to date with content/cv.yaml.
Result (42 files):
- 0 errors
- 0 warnings
- 0 hints
ok — project-subpath routes and assets share one deployment base
Cold-start adopter check: replace content only, then build both outputs.
Materialized 106 tracked paths; ignored and untracked build outputs were not copied.
ok — project-subpath routes and assets share one deployment base
All matched files use Prettier code style!

$ npm test
45 tests passed; cv/generated/cv-data.tex is up to date with content/cv.yaml.

$ npm run lint
eslint web — passed

The generated CV file's hash was unchanged because content/ was not changed.