Skip to content

[pull] main from TryGhost:main#1123

Merged
pull[bot] merged 8 commits intocode:mainfrom
TryGhost:main
May 7, 2026
Merged

[pull] main from TryGhost:main#1123
pull[bot] merged 8 commits intocode:mainfrom
TryGhost:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented May 7, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

9larsons and others added 8 commits May 6, 2026 17:25
no ref

- `.lintstagedrc.cjs` previously maintained a manual `SCOPED_WORKSPACES`
allowlist; files outside the listed workspaces fell through to a root
`eslint` invocation.
- That root path fails for workspaces whose eslint configs enable
`eslint-plugin-tailwindcss`. The plugin resolves tailwindcss via
`local-pkg.getPackageInfoSync("tailwindcss")` from `process.cwd()`, and
tailwindcss is not a root dependency. Result: `Error: Could not find
tailwindcss`.
- The allowlist was only extended reactively (e.g. `apps/posts` /
`apps/shade` in #26970 when Tailwind v4 + plugin v4-beta surfaced the
failure). Seven other workspaces have been latently broken for local
commits ever since: `apps/activitypub`, `apps/admin-x-design-system`,
`apps/admin-x-framework`, `apps/admin-x-settings`, `apps/comments-ui`,
`apps/signup-form`, `apps/stats`. CI doesn't notice because
`.github/hooks/pre-commit.bash` exits early under `$CI`.
- Replaced the allowlist with auto-discovery: walk up from each staged
file to its nearest `package.json` and run `pnpm --dir <ws> exec
eslint`. New workspaces and new tailwindcss-plugin adopters are picked
up automatically; the dichotomy between "scoped" and "root" eslint goes
away.
- Every workspace in the repo has an eslint config (either `.eslintrc.*`
/ `eslint.config.*` or an inline `eslintConfig` in `package.json`), so
scoped runs always find a config.
ref 986f78e

Let's test this middleware without stubbing.
no ref

Two related dep-contract hygiene fixes the post-knip-baseline audit
surfaced. Both came out of running `pnpm knip --debug` against `main`
after #27720 landed and verifying each entry by hand.
no ref

Settings tests were a bit flaky on CI - this is an attempt to resolve some of these.

- added a shared `waitForApiRequest` helper for Playwright acceptance
tests that inspect mocked API calls
- updated flaky-prone admin-x settings specs to wait for route-handler
captures before asserting request bodies/URLs
- updated design preview assertions to wait for the expected preview
header instead of reading the capture synchronously
no ref

Eight workspaces invoke `eslint` from their `lint` scripts but don't
declare `eslint` in `package.json`. Under pnpm strict isolation that
means no workspace-local `node_modules/.bin/eslint`, and the binary
resolves to whatever pnpm hoists at root level — currently
`apps/admin`'s `catalog:eslint9` (9.37.0). Their legacy `.eslintrc.cjs`
configs aren't compatible with ESLint 9, so `pnpm --filter <workspace>
lint` from the repo root fails locally with `ESLint couldn't find an
eslint.config.js file`.

This PR adds `"eslint": "catalog:"` (resolves to `8.57.1`) to each
affected workspace's devDeps so the local `.bin/eslint` shim is correct.
no ref

Follow-up to #27749 (`eslint` binary declarations). The same
strict-isolation principle applies to **eslint plugins and parsers**
referenced by `.eslintrc.cjs`/`.eslintrc.js` configs but not declared in
the consumer workspace's `package.json`. They currently resolve through
`eslint-plugin-ghost`'s transitive deps, which works today but violates
the same dep-contract Ghost is enforcing elsewhere.

This PR makes each workspace declare what it uses. It's part of cleanup related to `pnpm knip` output.
…typub (#27731)

no ref

Three workspaces — `apps/admin-x-framework` (the shared vite config)
plus its two audit-flagged consumers `apps/admin-x-settings` and
`apps/activitypub` — move from `vite@5.4.21 + vitest@1.6.1` to
`vite@7.3.2 + vitest@4.1.2`, matching what `apps/admin` already runs.
…7754)

no ref

Five vite-plugin declarations in three workspaces were redundant. Each
consumer's `vite.config.*` either delegates to
`@tryghost/admin-x-framework/vite` (which already imports the plugins
itself) or doesn't import the plugin at all. Removing the duplicate
`package.json` entries makes the dep contract honest and removes ~25
lines from the lockfile.
@pull pull Bot locked and limited conversation to collaborators May 7, 2026
@pull pull Bot added the ⤵️ pull label May 7, 2026
@pull pull Bot merged commit 0009ffb into code:main May 7, 2026
5 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants