Repository navigation
Reword JS runtime-order messages (bun, deno, pnpm, npm last resort) - #1049
Conversation
State the JS runtime order as a preference (bun, then deno, then pnpm; npm only when bun, deno and pnpm are all impossible) instead of saying npm/Deno are banned. Message text and comments only; no rule logic changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZpE5cb1MCPbmPbDjHg
|
Caution Review failedThe pull request is closed. Summary
Merge Risk:
 |
|
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7a0e8b163
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| glob: "package-lock.json", | ||
| reason: | ||
| "npm lockfile banned -- use Bun (`bun install`, bun.lock; JS runtime order Bun > pnpm > npm, Deno banned 2026-09-22, standards docs/JS-RUNTIME-POLICY.adoc)", | ||
| "npm lockfile not permitted here -- use Bun (`bun install`, bun.lock). JS runtime preference order: bun, then deno, then pnpm; npm only as a last resort when bun, deno and pnpm are all impossible (standards docs/JS-RUNTIME-POLICY.adoc)", |
There was a problem hiding this comment.
When bun, deno, and pnpm are all impossible, this diagnostic now tells the user that npm is an acceptable last resort, but check_commit_blocks/1 still unconditionally reports :nodejs_detected for any package-lock.json outside the fixed path allowlist; root hygiene also marks the lockfile high-severity/delete, and the similarly changed :npx_in_workflow rule still reports npm use. Thus following the new fallback guidance cannot make the scan pass. Either add an explicit last-resort exemption mechanism and explain it here, or avoid describing npm as usable.
Useful? React with 👍 / 👎.
Summary
Reword the JS runtime-order text in
lib/rules/cicd_rules.ex(:nodejs_detected,:npx_in_workflow) and the comment inlib/rules/root_hygiene.exso it states a preference order: bun, then deno, then pnpm; npm only as a last resort when bun, deno and pnpm are all impossible. No rule logic, patterns or severities change, and no extra toolchains are implied.Test plan
test/rules/cicd_rules_rescript_npm_js_test.exs, it should still hold ("use Bun", no "use Deno", "JS-RUNTIME-POLICY" all remain in the message). Only a comment in that test changed.Open question for the owner
The previous text said "Deno banned 2026-09-22". This PR follows the newer order in the hand-off brief, which lists deno second. Please confirm the Deno ruling has changed.
.machine_readable/MUST.contractilestill says "Deno only", and the README/docs were not touched.Generated by Claude Code