chore: switch to oxfmt, oxlint - add ci checks (#3977)

.github/labeler.yml

@@ -9,4 +9,4 @@
   - any: ["**/*.md"]
 
 "📌 area: ci":
-  - any: [".github/**/*"]
+  - any: [".github/**/*"]

.github/workflows/code-quality.yml

@@ -0,0 +1,38 @@
+name: "🎨 Format & Lint"
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  code-quality:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: ⎔ Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.2
+
+      - name: ⎔ Setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 20.20.2
+          cache: "pnpm"
+
+      - name: 📥 Download deps
+        run: pnpm install --frozen-lockfile
+
+      - name: 💅 Check formatting
+        run: pnpm exec oxfmt --check .
+
+      - name: 🔎 Lint
+        run: pnpm exec oxlint .

.github/workflows/dependabot-critical-alerts.yml

@@ -2,7 +2,7 @@ name: Dependabot Critical Alerts
 
 on:
   schedule:
-    - cron: "0 8 * * *"  # Daily 08:00 UTC
+    - cron: "0 8 * * *" # Daily 08:00 UTC
   workflow_dispatch:
     inputs:
       severity:

.github/workflows/dependabot-weekly-summary.yml

@@ -2,7 +2,7 @@ name: Dependabot Weekly Summary
 
 on:
   schedule:
-    - cron: "0 8 * * 1"  # Mon 08:00 UTC
+    - cron: "0 8 * * 1" # Mon 08:00 UTC
   workflow_dispatch:
 
 # Single-purpose monitoring workflow; serialise on workflow name only - we never
@@ -12,9 +12,9 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: read       # gh CLI baseline
-  pull-requests: read  # gh pr list (open dependabot PRs)
-  actions: read        # gh run list / view (parse latest dependabot run logs)
+  contents: read # gh CLI baseline
+  pull-requests: read # gh pr list (open dependabot PRs)
+  actions: read # gh run list / view (parse latest dependabot run logs)
 
 jobs:
   summary:

.github/workflows/pr_checks.yml

@@ -102,6 +102,11 @@ jobs:
               - 'pnpm-workspace.yaml'
               - 'turbo.json'
 
+  code-quality:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
+    uses: ./.github/workflows/code-quality.yml
+
   typecheck:
     needs: changes
     if: needs.changes.outputs.code == 'true' || needs.changes.outputs.typecheck_self == 'true'
@@ -155,6 +160,7 @@ jobs:
     name: All PR Checks
     needs:
       - changes
+      - code-quality
       - typecheck
       - webapp
       - e2e-webapp

.github/workflows/release-helm.yml

@@ -3,17 +3,17 @@ name: 🧭 Helm Chart Release
 on:
   push:
     tags:
-      - 'helm-v*'
+      - "helm-v*"
   workflow_call:
     inputs:
       chart_version:
-        description: 'Chart version to release'
+        description: "Chart version to release"
         required: true
         type: string
   workflow_dispatch:
     inputs:
       chart_version:
-        description: 'Chart version to release'
+        description: "Chart version to release"
         required: true
         type: string
 
@@ -58,7 +58,7 @@ jobs:
       - name: Validate manifests
         uses: docker://ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
         with:
-          entrypoint: '/kubeconform'
+          entrypoint: "/kubeconform"
           args: "-summary -output json ./helm-output"
 
   release:
@@ -134,7 +134,7 @@ jobs:
         run: |
           VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
           CHART_PACKAGE="/tmp/${{ env.CHART_NAME }}-${VERSION}.tgz"
-          
+
           # Push to GHCR OCI registry
           helm push "$CHART_PACKAGE" "oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts"
         env:
@@ -153,7 +153,7 @@ jobs:
               oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/${{ env.CHART_NAME }} \
               --version "${{ steps.version.outputs.version }}"
             ```
-            
+
             ### Changes
             See commit history for detailed changes in this release.
           files: |

.github/workflows/workflow-checks.yml

@@ -4,14 +4,14 @@ on:
   push:
     branches: [main]
     paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-      - '.github/zizmor.yml'
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
   pull_request:
     paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-      - '.github/zizmor.yml'
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
 
 permissions: {}
 

.github/zizmor.yml

@@ -2,4 +2,4 @@ rules:
   unpinned-uses:
     config:
       policies:
-        '*': hash-pin
+        "*": hash-pin