* root: switch cspell to typo-only reporting
cSpell's default mode reports every word it does not recognize, so each
new integration name or identifier needed a dictionary entry. Switch to
unknownWords: report-common-typos, which matches CodeSpell's behavior:
only known misspellings (reported with a suggested fix) and flagWords
fail the check.
Remove the per-topic dictionaries and word-shape ignore regexes this
makes unnecessary, fix the 18 typos the old allowlists were masking,
and document the new workflow.
Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
* web/docs: fix style-loader-plugin path and wording in CSS architecture doc
Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
* website: remove stray blank lines left by ignore-comment removal
Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
* Fix sub command syntax.
* Fix version drift.
* Add catalog lint.
* Add scripts.
* Tidy package configs.
* Add a local lint-catalogs target.
CI gained a catalogs check with no make counterpart, breaking the
documented promise that every ci-lint-* target has a local equivalent.
Also drops the second of two success log lines the script printed on
every clean run.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
---------
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* Replace npm + Corepack with pnpm
Migrate package management from npm + Corepack to pnpm across the root,
web, and website workspaces:
- Swap npm/Corepack tooling for pnpm: drop package-lock.json files and the
bespoke Corepack bootstrap scripts (setup-corepack.mjs, utils/corepack.mjs,
lint-lockfile.mjs); add pnpm-lock.yaml + pnpm-workspace.yaml per workspace.
- CI uses the official pnpm/action-setup + actions/setup-node; pin the pnpm
store dir via PNPM_HOME so setup-node's `cache: pnpm` post-step succeeds.
- Docker sources pnpm from the official ghcr.io/pnpm/pnpm image via a
${BUILDPLATFORM}-pinned stage; the website docs build does a hoisted root
install so @goauthentik/docusaurus-config resolves its own deps.
- Gate the web install on the `node` dep so runtime-only jobs don't invoke
pnpm; scope the from-stable env setup so the new tooling doesn't run against
the stable checkout's npm packageManager field.
- Resolve @goauthentik/api (client-ts) from its TypeScript source instead of a
tsc-built dist, so it no longer depends on an install-time prepare having run
(the storybook build's environment never built it); sfe's rollup gains .ts
resolution to match.
- Netlify builds with pnpm; encode pnpm's supply-chain controls
(onlyBuiltDependencies/allowBuilds, minimumReleaseAge) in the workspace.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove custom node action.
* Format.
The three Node scripts that run under `setup-node` (lint-lockfile,
lint-runtime, setup-corepack) finish their main work but the Node
process does not exit — the event loop is kept alive by an outstanding
handle from one of the upstream libraries. In CI this causes the step
to hang indefinitely until the runner timeout fires.
Add an explicit `process.exit(0)` after the success path in each
script. setup-corepack is restructured so `main()` returns the
`$`corepack …`` promise and the success log moves into `.then()`
before the exit, keeping ordering deterministic.
Co-authored-by: Agent (authentik-m-split-pr-committed-every-mikado) <279763771+playpen-agent@users.noreply.github.com>
* core: add .npmrc baseline to block dependency lifecycle scripts
Set ignore-scripts=true at the repo root, plus engine-strict, save-exact,
audit, and prefer-offline. This neutralizes the dominant npm supply-chain
attack vector — postinstall scripts in transitive dependencies — at the
cost of requiring an explicit rebuild for the handful of packages that
legitimately need install scripts (esbuild, chromedriver, tree-sitter,
tree-sitter-json). The next commit wires that rebuild into the Makefile.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* core: route node installs through make to retire website preinstall hook
Make docs-install depend on a new root-node-install so the root deps
are guaranteed before the website install runs, removing the need for
the website/preinstall lifecycle script. Rebuild the small audited list
of trusted packages (esbuild, chromedriver, tree-sitter, tree-sitter-json)
after the web install so ignore-scripts=true remains the only path that
needs maintenance. web/README documents the new workflow.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* Clean up install scripts.
* Track .npmrc in CODEOWNERS
* Fix formatter config. Reformat.
* Fix mounted references.
* Flesh out node scripts.
* Bump engines.
* Prep containers.
* Update makefile.
* Flesh out github actions.
* Clean up docs container.
* lint.
Bump.
Lint.
Bump NPM version.
* Add limits.
* collapse the composite's three setup-node calls to one cache restore
* Add SHA.
* Bump NPM range.
* Run formatter.
* Bump NPM.
* Remove extra install.
* Fix website deps.
* Use local prettier. Fix drift in CI.
* ci: build frontend in CI with node_env production
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
* Install docusaurus config.
* Fix linter warning, order.
* Add linter commands.
* Add timeout.
* Remove pre install check.
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
