CI static analysis #15

New issue

Closed

opened 2026-06-12 20:27:47 +00:00 by james · 0 comments

james commented

2026-06-12 20:27:47 +00:00

Owner

Lint + typecheck are already in #13. This ticket adds deeper analysis.

Scope

typescript-eslint strict rule set on top of the base ESLint config.
A Semgrep ruleset for common JS/TS bug patterns (untrusted-input flows, dangerous APIs).
Runs on PR; finding above threshold fails the check.

Acceptance criteria

A planted unsafe pattern (e.g. eval, raw-string SQL concatenation) trips the check in a throwaway branch.
Findings are surfaced in the PR output clearly.

Part of epic #2. Depends on #13.

Lint + typecheck are already in #13. This ticket adds deeper analysis. ## Scope - `typescript-eslint` strict rule set on top of the base ESLint config. - A Semgrep ruleset for common JS/TS bug patterns (untrusted-input flows, dangerous APIs). - Runs on PR; finding above threshold fails the check. ## Acceptance criteria - [ ] A planted unsafe pattern (e.g. `eval`, raw-string SQL concatenation) trips the check in a throwaway branch. - [ ] Findings are surfaced in the PR output clearly. Part of epic #2. Depends on #13.

james added the

area:ci

label

2026-06-12 20:31:55 +00:00

james referenced this issue from a commit

2026-06-14 01:45:53 +00:00

CI static analysis: typescript-eslint strict + Semgrep (#15)

james referenced this issue from a pull request that will close it,

2026-06-14 01:49:35 +00:00

CI static analysis: typescript-eslint strict + Semgrep (#15) #41

james referenced this issue from a commit

2026-06-14 13:15:47 +00:00