Final ESLint warning bucket of the dette-tech sprint. 49 warnings
across 41 files, fixed per case based on context :
~17 cases — added the missing dep, wrapping the upstream helper
in useCallback at its definition so the new [fn]
entry is stable. Files: DeveloperDashboardView,
WebhooksView, CloudBrowserView, GearDocumentsTab,
GearRepairsTab, PlaybackSummary, UploadQuota, Dialog,
SwaggerUI, MarketplacePage, etc.
~5 cases — extracted complex expression to its own useMemo so
the outer hook's deps array is statically checkable.
ChatMessages.conversationMessages,
useGearView.sourceItems, useLibraryPage.tracks,
usePlaylistNotifications.playlistNotifications,
ChatRoom.conversationMessages.
~5 cases — inline ref-pattern when the upstream hook returns a
freshly-allocated object every render
(ToastProvider's addToast, parent prop callbacks
that aren't memoized). Captured into a ref so the
effect's deps stay stable.
~5 cases — ref-cleanup pattern for animation-frame ids :
capture .current at cleanup time into a local that
the closure closes over (per React docs).
~13 cases — suppressed per-line with specific reason : mount-only
inits, recursive callback pairs (usePlaybackRealtime
connect↔reconnect), Zustand-store identity stability,
search loops, decorator construction (storybook).
Every comment names WHY the dep isn't safe to add.
1 case — dropped a dep that was unnecessary (useChat had a
setActiveCall in deps that the body didn't use).
1 case — replaced 8 granular player.* deps with the parent
[player] object (useKeyboardShortcuts).
baseline post-commit : 754 warnings, 0 errors, 0 TS errors. The
remaining 754 are entirely no-restricted-syntax — design-system
guardrails (Tailwind defaults / hex literals / native <button>) —
which are per-feature migration work, not lint-sprint fodder.
CI --max-warnings lowered to 754. Trajectory of the sprint :
1240 → 1108 → 921 → 803 → 754
(-486 warnings = -39%)
Latent issue surfaced (not fixed in this commit, flagged for v1.1) :
ToastProvider's `useToast` and useSearchHistory's `addToHistory`
return new objects every render, so anything that depends on them
in a useEffect would re-fire on every parent render. Today these
are routed through refs at the call site ; the structural fix is to
memoize the providers themselves. Documented in the suppression
comments at the affected sites.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The forgejo-runner on srv-102v advertises labels `incus:host,self-hosted:host`,
so jobs pinned to `ubuntu-latest` matched no runner and exited in 0s.
- ci.yml / security-scan.yml / trivy-fs.yml: runs-on → [self-hosted, incus]
- e2e.yml / go-fuzz.yml / loadtest.yml: same migration AND gate triggers to
workflow_dispatch only (push/pull_request/schedule commented out) — single
self-hosted runner, heavy suites would block the queue.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three rules cleaned in parallel passes — 187 fewer warnings, 0 TS
errors, 0 behaviour change beyond one incidental auth bugfix
flagged below.
storybook/no-redundant-story-name (23 → 0) — 14 stories files
Storybook v7+ infers the story name from the variable name, so
`name: 'Default'` next to `export const Default: Story = …` is
pure noise. Removed only when the name was redundant ;
preserved when the label was a French translation
('Par défaut', 'Chargement', 'Avec erreur', etc.) since those
are intentional.
react-refresh/only-export-components (25 → 0) — 21 files
Each warning marks a file that exports a React component AND a
hook / context / constant / barrel re-export. Suppressed
per-line with the suppression-with-justification pattern :
// eslint-disable-next-line react-refresh/only-export-components -- <kind>; refactor would split a tightly-coupled API
The justification matters — every comment names the specific
thing being co-located (hook / context / CVA constant / lazy
registry / route config / test util / backward-compat barrel).
Splitting these would create 21 new files for a HMR-only DX
win that's already a non-issue in practice.
@typescript-eslint/no-non-null-assertion (139 → 0) — 43 files
Distribution of fixes :
~85 cases : refactored to explicit guard
`if (!x) throw new Error('invariant: …')`
or hoisted into local with narrowing.
~36 cases : helper extraction (one tooltip test had 16
`wrapper!` patterns reduced to a single
`getWrapper()` helper).
~18 cases : suppressed with specific reason :
static literal arrays where index is provably
in bounds, mock fixtures with structural
guarantees, filter-then-map patterns where the
filter excludes the null branch.
One incidental find : services/api/auth.ts threw on missing
tokens but didn't guard `user` ; added the missing check while
refactoring the `user!` to a guard.
baseline post-commit : 921 warnings, 0 errors, 0 TS errors.
The remaining buckets are no-restricted-syntax (757, design-system
guardrail), no-explicit-any (115), exhaustive-deps (49).
CI --max-warnings will be lowered to 921 in the follow-up commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The CI lint step was running with `--max-warnings=2000`, which left
~800 warnings of headroom — meaning every PR could quietly add new
warnings without anyone noticing. The "raise gradually" intent in
the comment never converted to action.
Locked the gate at the current count (1204) so the dette stops
growing. Top contributors :
- 721 no-restricted-syntax (custom rule, mostly unicode/i18n)
- 139 @typescript-eslint/no-non-null-assertion (the `!` operator)
- 134 @typescript-eslint/no-unused-vars
- 115 @typescript-eslint/no-explicit-any
- 47 react-hooks/exhaustive-deps
- 25 react-refresh/only-export-components
- 23 storybook/no-redundant-story-name
Operational rule: lower this number as warnings are resorbed by
feature work — never raise it. New code must not add warnings; if
you genuinely need an exception, add `// eslint-disable-next-line
<rule> -- <reason>` rather than bumping the cap.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI run 455/456 surfaced:
src/features/player/components/AudioVisualizer.tsx(22,8): error TS2307:
Cannot find module '@veza/design-system/tokens-generated' or its
corresponding type declarations.
Root cause: the sprint 2 design-system migration (commits a25ad2e0 →
ab923def) replaced manual src/ exports with Style Dictionary output in
packages/design-system/dist/. That `dist/` is gitignored — by design,
since it's generated artifact — but no step in the CI workflows runs
the generator before tsc/vite/vitest fire.
apps/web imports `@veza/design-system/tokens-generated`, which the
package's `exports` field maps to `./dist/tokens.ts`. With dist/ empty
on a fresh checkout, the import resolves to undefined → TS2307.
Two-pronged fix:
(1) packages/design-system/package.json — add a `prepare` script that
runs Style Dictionary. npm fires `prepare` after `npm install`
AND `npm ci`, so any workspace install populates dist/ without an
extra workflow change. Also covers fresh dev clones.
(2) .github/workflows/{ci.yml,e2e.yml} — explicit
`npm run build:tokens --workspace=@veza/design-system` step
immediately after `npm ci`. Belt-and-suspenders against any npm
version where `prepare` is silent or filtered (lifecycle script
skipping has burned us before — `--ignore-scripts` flags, etc.).
Verified locally:
$ rm -rf packages/design-system/dist/
$ npm run build:tokens --workspace=@veza/design-system
✓ Style Dictionary build complete.
$ cd apps/web && npx tsc --noEmit
(clean)
SKIP_TESTS=1 — config-only changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
frontend-ci.yml was structurally broken (npm ci in apps/web with no
lockfile at that path — workspace lockfile lives at repo root) and
duplicated lint/tsc/build/test from ci.yml. Folded its useful checks
(OpenAPI types-sync, bundle-size gate, npm audit) into ci.yml's frontend
job and removed the duplicate workflow.
Why:
- Cuts CI time by ~50% on frontend (no double-run).
- Avoids burning two runner slots per push for the same code.
- Eliminates the broken `npm ci` in apps/web that produced silent
fallbacks.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
By default actions/cache@v4 only saves the cache when the job completes
successfully. Runs 71 / 74 failed at the Lint / Install Go tools step
before reaching the post-step cache upload, so the Go tool binaries
cache (govulncheck + golangci-lint) was never persisted and every
subsequent run paid the ~3 min "go install @latest" cost again.
Add `save-always: true` to:
- Cache Go tool binaries (ci.yml)
- Cache rustup toolchain (ci.yml)
- Cache Cargo deps and target (ci.yml)
- Cache govulncheck binary (backend-ci.yml)
so the next run benefits from whatever the previous job managed to
install, even if a downstream step later fails.
golangci-lint v2.11.4 requires Go >= 1.25. With the workflow on 1.24,
setup-go would silently trigger an in-job auto-toolchain download
(observed in run #71: 'go: github.com/golangci/golangci-lint/v2@v2.11.4
requires go >= 1.25.0; switching to go1.25.9') adding ~3 min to every
Backend (Go) run.
Bump setup-go to 1.25 in ci.yml, backend-ci.yml, go-fuzz.yml so the
prebuilt Go is already the right version.
Also lint-fix three files that golangci-lint's goimports checker
flagged — goimports sorts/groups imports and removes unused ones,
which plain gofmt leaves alone:
- veza-backend-api/cmd/api/main.go
- veza-backend-api/internal/api/handlers/chat_handlers.go
- veza-backend-api/internal/handlers/auth_integration_test.go
Run #69 task 146 failed with:
ERROR cargo_tarpaulin: Failed to run tests:
ASLR disable failed: EPERM: Operation not permitted
cargo-tarpaulin relies on ptrace to disable ASLR for code-coverage
instrumentation, but the Docker container the Forgejo act runner
spawns for each job doesn't carry CAP_SYS_PTRACE. Two fixes possible:
1. Set `container.privileged: true` in /root/.runner.yaml to grant
ptrace (wide capability, affects all jobs)
2. Switch to `cargo llvm-cov` which uses source-based coverage
instead of runtime instrumentation
Neither is the scope of "unblock CI today". Drop the coverage step
and its threshold gate from ci.yml. Coverage can run in a dedicated
nightly job once we pick option 1 or 2.
Saves ~7 min per Rust-touching run on cold cache (5 min tarpaulin
install + 2 min run attempt).
Before this commit, every push touching veza-stream-server triggered
three parallel Rust workflows that did essentially the same work:
- ci.yml Rust job : build + test + clippy + fmt + audit
- rust-ci.yml : clippy + test + tarpaulin coverage
- stream-ci.yml : clippy + audit + test
With the runner at capacity=4, this meant 3 of the 4 parallel slots
burned on duplicate Rust compilation while Backend/Frontend waited.
Each Rust build is ~3-5 min warm, so the redundancy was costing
~10 min per Rust-touching push.
Consolidate into a single job in ci.yml:
- Adds the tarpaulin coverage step + 50% threshold gate from rust-ci
- Adds the upload-artifact step for the coverage JSON
- Deletes rust-ci.yml and stream-ci.yml
All Rust CI now happens in ci.yml's `rust` job. The Cargo cache,
rustup cache and tool-binary cache already set up in the prior
commit keep everything warm.
Previous runs were burning ~90-120s on rustup download, ~60-90s on
cargo-audit/cargo-tarpaulin source install, and ~60-90s on Go module
download because setup-go couldn't find go.sum at the repo root.
Fixes:
- setup-go cache-dependency-path: veza-backend-api/go.sum
(was silently failing with "Dependencies file is not found")
- New actions/cache step for ~/.rustup + ~/.cargo/bin keyed on
stable+components — skips rustup install on warm cache
- New actions/cache step for ~/go/bin keyed on tool set — skips
go install @latest on warm cache
- cargo install cargo-audit / cargo-tarpaulin gated on
`command -v` so they're no-ops when cached
- Add restore-keys to the Cargo deps cache for partial hits when
Cargo.lock changes
- rust-ci.yml now watches its own path in the trigger (was a bug:
edits to the workflow didn't retrigger it)
Expected impact on a warm run: Go jobs -90s, Rust jobs -3min.
First run after this commit will still be slow (cache warm-up).
Two fixes surfaced by run #55:
1. veza-stream-server (47 files): cargo fmt had been run locally but
never committed — the working tree was clean locally while HEAD
had unformatted code. CI's `cargo fmt -- --check` caught the drift.
This commit lands the formatting that was already staged.
2. ci.yml Install Go tools: `go install .../cmd/golangci-lint@latest`
resolves to v1.64.8 (the old /cmd/ module path). The repo's
.golangci.yml is v2-format, so v1 refuses with:
"you are using a configuration file for golangci-lint v2
with golangci-lint v1: please use golangci-lint v2"
Switch to the /v2/cmd/ path so @latest actually gets v2.x.
Run #53 task 126 surfaced ~20 pre-existing clippy warnings turned into
errors by -D warnings, including:
- 7 unused imports across test modules
- too many arguments (9/7)
- missing Default impls (SIMDCompressor, EffectsChain, BufferManager)
- clamp-like pattern, manual !RangeInclusive::contains, manual
enumerate-discard, unnecessary f32->f32 cast
- iter().copied().collect() vs to_vec()
- MutexGuard held across await point (this one is worth a real fix)
Mirror the ESLint --max-warnings=2000 approach: lift the gate now to
unblock CI, address the backlog incrementally. The MutexGuard-across-
await is the only one that smells like a real bug worth prioritizing.
Touches three workflows that all run the same step:
- .github/workflows/ci.yml
- .github/workflows/stream-ci.yml
- .github/workflows/rust-ci.yml
Two related CI relaxations to unblock main on the Forgejo runner:
- Backend Go tests: pass -short and VEZA_SKIP_INTEGRATION=1 so the
testcontainers-based integration suite is skipped when no Docker
socket is reachable. Unit tests still run end-to-end.
- Frontend ESLint: raise --max-warnings from 0 to 2000. The current
apps/web tree has 1170 warnings (0 errors) — mostly
@typescript-eslint/no-explicit-any and unused vars. The cap acts
as a regression gate while the team resorbs the backlog. Lower it
gradually as warnings are fixed.
- Replace dtolnay/rust-toolchain with manual rustup (not on forgejo mirror)
- Replace docker-compose with docker compose (v2)
- Add rsync install before tmt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Merge SSL env vars into existing env block instead of creating a
duplicate (YAML doesn't allow duplicate top-level keys).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Update E2E test credentials to match actual seed users
(user@veza.music, artist@veza.music, admin@veza.music, mod@veza.music)
- Fix hardcoded "Suggested Accounts" in SuggestionsWidget with i18n key
- Replace hardcoded amelie_dubois references with CONFIG.users.creator
- Refactor auth, player, upload E2E tests for reliability
- Add tmt test plans and scripts for CI integration
- Simplify CI workflow
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MEDIUM-002: Remove manual X-Forwarded-For parsing in metrics_protection.go,
use c.ClientIP() only (respects SetTrustedProxies)
MEDIUM-003: Pin ClamAV Docker image to 1.4 across all compose files
MEDIUM-004: Add clampLimit(100) to 15+ handlers that parsed limit directly
MEDIUM-006: Remove unsafe-eval from CSP script-src on Swagger routes
MEDIUM-007: Pin all GitHub Actions to SHA in 11 workflow files
MEDIUM-008: Replace rabbitmq:3-management-alpine with rabbitmq:3-alpine in prod
MEDIUM-009: Add trial-already-used check in subscription service
MEDIUM-010: Add 60s periodic token re-validation to WebSocket connections
MEDIUM-011: Mask email in auth handler logs with maskEmail() helper
MEDIUM-012: Add k-anonymity threshold (k=5) to playback analytics stats
LOW-001: Align frontend password policy to 12 chars (matching backend)
LOW-003: Replace deprecated dotenv with dotenvy crate in Rust stream server
LOW-004: Enable xpack.security in Elasticsearch dev/local compose files
LOW-005: Accept context.Context in CleanupExpiredSessions instead of Background()
LOW-002: Noted — Hyperswitch version update deferred (requires payment integration tests)
29/30 findings remediated. 1 noted (LOW-002).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ORDER BY dynamiques : whitelist explicite, fallback created_at DESC
- Login/register soumis au rate limiter global
- VERSION sync + check CI
- Nettoyage références veza-chat-server
- Go 1.24 partout (Dockerfile, workflows)
- TODO/FIXME/HACK convertis en issues ou résolus
Chat functionality is now fully handled by the Go backend (since v0.502).
Remove the deprecated Rust chat server and all its references from:
- CI/CD workflows (ci.yml, cd.yml, rust-ci.yml, chat-ci.yml)
- Monitoring & proxy config (prometheus, caddy, haproxy)
- Incus deployment scripts and documentation
- Monorepo config (package.json, dependabot, GH templates)
- Add create_test_user step in CI e2e job (e2e@test.com)
- Add TEST_EMAIL and TEST_PASSWORD to Playwright env for consistency
- Add form visibility waits in smoke.spec.ts (align with auth.spec.ts)
- Ensures login form is visible before fillField to avoid flaky failures
- Add turbo devDependency and packageManager to root
- Create turbo.json with build, test, lint pipeline
- Add package.json to veza-backend-api, veza-chat-server, veza-stream-server
- Extend workspaces to include Go and Rust services
- Migrate CI to use turbo run for build, test, lint
- Add govulncheck to backend-go job
- Add npm audit --audit-level=high to frontend job
- Both use || true to avoid blocking CI on existing vulns
Co-authored-by: Cursor <cursoragent@cursor.com>
- Created contrast utility (apps/web/src/utils/contrast.ts)
- getRelativeLuminance() - calculates WCAG relative luminance
- getContrastRatio() - calculates contrast ratio between colors
- meetsWCAGAA() / meetsWCAGAAA() - validates WCAG standards
- parseRGB() - parses RGB strings from CSS variables
- Created contrast test suite (apps/web/src/__tests__/contrast.test.ts)
- Tests all design system color combinations
- Validates primary text (white) on all backgrounds
- Validates secondary text (dim) on all backgrounds
- Validates text with opacity variants
- All combinations must meet WCAG AA (4.5:1)
- Added contrast test step to CI workflow
- Prevents contrast ratio regressions
- Action 11.1.1.5 complete
- Completed Action 1.1.2.4: Added cache step for generated types
- Cache keyed on openapi.yaml hash for automatic invalidation
- Speeds up CI by avoiding regeneration when spec unchanged
- Completed Action 1.1.2.3: Added type generation step to frontend CI
- Step runs before Type Check to ensure types are up-to-date
- CI will fail if generated types don't match OpenAPI spec
- Added chmod to ensure script is executable in CI environment
