ci: install enforced gate baseline

.github/workflows/ci.yml

@@ -10,14 +10,41 @@ permissions:
   contents: read
 
 jobs:
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Gitleaks
+        run: |
+          curl --fail --silent --show-error --location --output gitleaks.tar.gz \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz' | sha256sum --check
+          tar --extract --gzip --file gitleaks.tar.gz --directory "$RUNNER_TEMP" gitleaks
+      - run: |
+          "$RUNNER_TEMP/gitleaks" git --redact --no-banner .
+
+  dependency-audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: google/osv-scanner-action/osv-scanner-action@8dded7155905cd666190a12dc9997000e58d163d # v2.0.2
+        with:
+          scan-args: |-
+            --recursive
+            ./
+
   headless-smoke:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: subosito/flutter-action@v2
         with:
           channel: stable
-      - run: dart pub get
+      - run: dart pub get --enforce-lockfile
         working-directory: app
       - run: bash scripts/warm-flutter-task-pub-cache.sh
       - run: dart format --set-exit-if-changed bin lib/core lib/export lib/headless lib/runner lib/storage lib/tasks test/core test/headless test/runner test/support test/tasks

.github/workflows/official-corpus.yml

@@ -81,7 +81,7 @@ jobs:
       - uses: subosito/flutter-action@v2
         with:
           channel: stable
-      - run: flutter pub get
+      - run: flutter pub get --enforce-lockfile
         working-directory: app
       - run: bash scripts/warm-flutter-task-pub-cache.sh
       - run: flutter test --concurrency=1 test/tasks/official_file_backed_task_test.dart

.gitleaksignore

@@ -0,0 +1,5 @@
+# Synthetic benchmark metadata; retained visibly under pickforge/pickarena#43.
+3b582f9a76e52a9ffd292a6d072c65c894877e65:tasks/flutter/navigation.auth_redirect_race/qa/admission_report.json:generic-api-key:88
+51168b84f198e58135f4a891807249143e84f38f:web/static/data/release_report.v1.json:generic-api-key:1612
+51168b84f198e58135f4a891807249143e84f38f:web/static/data/release_report.v1.json:generic-api-key:1621
+51168b84f198e58135f4a891807249143e84f38f:web/static/data/release_report.v1.json:generic-api-key:1623

package.json

@@ -3,6 +3,11 @@
   "workspaces": [
     "web"
   ],
+  "overrides": {
+    "cookie": "0.7.2",
+    "esbuild": "0.28.1",
+    "vite": "7.3.6"
+  },
   "scripts": {
     "app:pub": "cd app && dart pub get",
     "app:analyze": "cd app && dart analyze",

web/eslint.config.js

@@ -0,0 +1,43 @@
+import svelte from 'eslint-plugin-svelte';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+const complexityRules = {
+  complexity: ['error', 15],
+  'max-depth': ['error', 4],
+  'max-lines-per-function': [
+    'error',
+    { max: 100, skipBlankLines: true, skipComments: true }
+  ]
+};
+
+export default [
+  {
+    ignores: ['.svelte-kit/**', 'build/**', 'coverage/**']
+  },
+  {
+    files: ['src/**/*.ts', 'scripts/**/*.ts', '*.config.ts'],
+    languageOptions: {
+      globals: { ...globals.browser, ...globals.node },
+      parser: tseslint.parser
+    },
+    rules: complexityRules
+  },
+  ...svelte.configs['flat/base'],
+  {
+    files: ['src/**/*.svelte'],
+    languageOptions: {
+      globals: globals.browser,
+      parserOptions: {
+        parser: tseslint.parser
+      }
+    },
+    rules: complexityRules
+  },
+  {
+    files: ['**/*.test.ts'],
+    rules: {
+      'max-lines-per-function': 'off'
+    }
+  }
+];

web/package.json

@@ -8,17 +8,24 @@
     "build": "vite build",
     "preview": "vite preview",
     "smoke": "bun run build && bun run scripts/smoke-static.ts",
-    "test": "bun test scripts/leaderboard-contract.test.ts",
-    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json"
+    "test": "vitest run",
+    "lint": "eslint src scripts '*.config.ts'",
+    "check": "bun run lint && svelte-kit sync && svelte-check --tsconfig ./tsconfig.json"
   },
   "devDependencies": {
-    "@types/node": "^24.10.1",
     "@sveltejs/adapter-static": "^3.0.8",
     "@sveltejs/kit": "^2.27.0",
     "@sveltejs/vite-plugin-svelte": "^6.2.1",
+    "@types/node": "^24.10.1",
+    "@vitest/coverage-v8": "^3.2.4",
+    "eslint": "^9.30.1",
+    "eslint-plugin-svelte": "^3.9.3",
+    "globals": "^16.3.0",
     "svelte": "^5.38.7",
     "svelte-check": "^4.3.1",
     "typescript": "^5.9.2",
-    "vite": "^7.1.3"
+    "typescript-eslint": "^8.35.1",
+    "vite": "^7.1.3",
+    "vitest": "^3.2.4"
   }
 }

web/scripts/leaderboard-contract.test.ts

@@ -3,7 +3,7 @@ import { readFile, readdir } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { describe, expect, mock, test } from 'bun:test';
+import { describe, expect, test, vi } from 'vitest';
 
 import {
   acceptedDataPolicies,
@@ -12,7 +12,7 @@ import {
   type LeaderboardData
 } from '../src/lib/data/leaderboard-contract';
 
-mock.module('$app/paths', () => ({ base: '' }));
+vi.mock('$app/paths', () => ({ base: '' }));
 const { loadLeaderboard } = await import('../src/lib/data/leaderboard');
 
 type FixtureEntry = {

web/vitest.config.ts

@@ -0,0 +1,18 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  plugins: [sveltekit()],
+  test: {
+    coverage: {
+      enabled: true,
+      include: ['src/**/*.{ts,svelte}'],
+      provider: 'v8',
+      reporter: ['text', 'json-summary'],
+      thresholds: {
+        branches: 81,
+        lines: 56
+      }
+    }
+  }
+});