tech-debt batch 2: type-checked ESLint + CI hygiene (#149/#160)

.github/workflows/docker-publish.yml

@@ -15,24 +15,47 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Build test image
-        run: docker build --target test -t ember-test ./app
+        # Shared buildx GHA cache (distinct scope=test so it never collides with
+        # smoke-boot's or build-push's cache). --load makes the image available to
+        # the subsequent `docker run`. Same target/tag the run step expects.
+        run: >-
+          docker buildx build
+          --cache-from type=gha,scope=test
+          --cache-to type=gha,mode=max,scope=test
+          --load --target test -t ember-test ./app
 
       - name: Run unit tests
         run: docker run --rm ember-test
 
+      # Report-only coverage for the pure libs (#160): never gates the build (no
+      # thresholds — see app/vitest.config.ts), just surfaces the text-summary in
+      # the job summary so an untested new pure fn is visible in review. Runs in a
+      # throwaway container off the same hermetic test image.
+      - name: Coverage report (pure libs, report-only)
+        if: always()
+        run: |
+          {
+            echo "## Unit test coverage (pure libs — report-only, no gate)"
+            echo ""
+            echo '```'
+            docker run --rm ember-test npm run test:coverage 2>&1 \
+              | sed -n '/Coverage report from v8/,$p'
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
   # Static analysis: ESLint (next/core-web-vitals) + a TypeScript typecheck
   # (tsc --noEmit). Runs on every PR + push; gates the publish.
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
 
@@ -87,11 +110,11 @@ jobs:
     env:
       DATABASE_URL: postgresql://ngrid:ci@localhost:5432/ngrid
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # need tags to resolve the previous release schema
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
 
@@ -140,18 +163,25 @@ jobs:
     env:
       DATABASE_URL: postgresql://ngrid:ci@localhost:5432/ngrid?schema=public
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # tags so the build can stamp a git-describe version
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Build the runner image (as shipped)
         # Stamp the same git-describe version the real edge/main build uses, so the
         # boot-health summary shows a meaningful version (not 0.0.0-dev).
+        # Shared buildx GHA cache (distinct scope=smoke so it never collides with
+        # the test job's or build-push's cache). --load makes the runner image
+        # available to the subsequent `docker run`. No --target: builds the final
+        # runner stage exactly as shipped, same as before.
         run: |
           ver="$(git describe --tags --always | sed 's/^v//')"
-          docker build --build-arg APP_VERSION="$ver" -t ember-boot ./app
+          docker buildx build \
+            --cache-from type=gha,scope=smoke \
+            --cache-to type=gha,mode=max,scope=smoke \
+            --load --build-arg APP_VERSION="$ver" -t ember-boot ./app
 
       - name: Boot the image
         run: |
@@ -278,11 +308,11 @@ jobs:
       DB_NAME: ngrid
       DB_PASSWORD: p%a@s#s$
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # tags, in case the schema-delta setup wants prior releases
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
 
@@ -442,11 +472,11 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # need tags so `git describe` can version edge builds
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Resolve app version
         id: ver
@@ -462,15 +492,15 @@ jobs:
           echo "APP_VERSION=$v"
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Image metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/ember
           # Publishing a GitHub Release (tag vX.Y.Z) publishes X.Y.Z, X.Y, X and moves
@@ -488,7 +518,7 @@ jobs:
             latest=false
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./app
           push: true

.gitignore

@@ -8,6 +8,7 @@ app/.next/
 app/next-env.d.ts
 app/.tsbuildinfo
 *.tsbuildinfo
+app/coverage/
 
 # misc
 .DS_Store

app/.eslintrc.json

@@ -1,4 +1,19 @@
 {
   "root": true,
-  "extends": "next/core-web-vitals"
+  "extends": "next/core-web-vitals",
+  "overrides": [
+    {
+      "files": ["src/lib/**/*.ts", "src/lib/**/*.tsx"],
+      "parser": "@typescript-eslint/parser",
+      "parserOptions": {
+        "project": "./tsconfig.json"
+      },
+      "plugins": ["@typescript-eslint"],
+      "rules": {
+        "@typescript-eslint/no-floating-promises": "error",
+        "@typescript-eslint/no-misused-promises": "error",
+        "@typescript-eslint/no-explicit-any": "warn"
+      }
+    }
+  ]
 }