ci: non-blocking full typecheck lane + pre-commit hooks

[therealityreport]

What

Phase 1 (app side) of the tooling upgrade.

• web-tests.yml: adds a non-blocking full pnpm typecheck step (the blocking gate still runs typecheck:fandom). Surfaces the full-typecheck backlog without blocking merges; flip to blocking once green.
• .pre-commit-config.yaml: gitleaks + ruff (for the Python repo-map scripts) on commit; eslint at pre-push (kept off per-commit since the Next lint pass is heavy).

Notes

Pure CI/config; no apps/web source changes. Branched from origin/main.

Summary by CodeRabbit

• Chores
  • Enhanced CI/CD pipeline with comprehensive TypeScript type checking
  • Implemented pre-commit hooks for code quality assurance, including secret scanning, linting, and code formatting validation

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
trr-app	Ready	Preview, Comment	Jun 18, 2026 2:58pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: aa00c0a6-13b3-4d54-a7ce-783bf2a089de

📥 Commits

Reviewing files that changed from the base of the PR and between f5688f5 and 53bbfe3.

📒 Files selected for processing (2)

• .github/workflows/web-tests.yml
• .pre-commit-config.yaml

---

📝 Walkthrough

Walkthrough

Adds a non-blocking full TypeScript typecheck step (continue-on-error: true) to the full lane of the GitHub Actions web-tests workflow. Introduces a new .pre-commit-config.yaml with hooks for secret scanning (gitleaks), Python linting/formatting (ruff), file hygiene checks, and a pre-push-scoped ESLint hook for apps/web.

Changes

CI and Developer Tooling

Layer / File(s)	Summary
Non-blocking full typecheck in CI .github/workflows/web-tests.yml	Inserts a new step gated to matrix.lane == 'full' that runs the full project TypeScript typecheck with continue-on-error: true, so failures are visible but do not block the workflow.
Pre-commit hook configuration .pre-commit-config.yaml	Adds a complete pre-commit config: gitleaks v8.21.2 for secret scanning, ruff v0.14.4 with --fix and ruff-format, standard hygiene hooks (merge conflict detection, EOF fixer, trailing whitespace with Next.js build artifact exclusions), and a local eslint-web hook scoped to apps/web TypeScript/TSX files running only on pre-push.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

A rabbit checks secrets before every leap,
ruff tidies the Python while eslint won't sleep,
typecheck runs quiet, won't block the whole queue,
pre-commit stands guard at the gate, good as new.
🐇✨ Onwards we hop, with clean code to pursue!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the two main changes: adding a non-blocking full typecheck lane and configuring pre-commit hooks, which aligns with the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/ci-precommit-hardening

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds developer- and CI-facing tooling to surface broader TypeScript typecheck issues without blocking merges, while introducing opt-in local pre-commit/pre-push hygiene checks.

Changes:

• Adds a non-blocking pnpm run typecheck step to the Node 24 “full” lane to surface full-project type errors while keeping the existing typecheck:fandom gate.
• Introduces a .pre-commit-config.yaml with gitleaks + ruff on commit, plus an apps/web eslint hook on pre-push.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.pre-commit-config.yaml	Adds pre-commit/pre-push hooks (gitleaks, ruff, and a local eslint pre-push hook for apps/web).
.github/workflows/web-tests.yml	Adds a non-blocking full typecheck step in the “full” CI lane to surface backlog without gating merges.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Codex Exhaustive Code Review

Findings

1. Medium - .pre-commit-config.yaml: hooks intended for commit-time also run at pre-push.
   Because the config does not set default_stages, hooks without explicit stages inherit pre-commit’s default of all stages. The setup instructions install a pre-push hook, so gitleaks, ruff --fix, ruff-format, end-of-file-fixer, and trailing-whitespace can run during push, not just commit. That means a push can unexpectedly mutate the working tree after commits are already made, and gitleaks runs its pinned --staged scan at pre-push rather than scanning pushed commits. Smallest fix: add default_stages: [pre-commit] near line 14, or add stages: [pre-commit] to the non-eslint hooks and keep only eslint-web on pre-push. (pre-commit.com)

2. Low - .github/workflows/web-tests.yml: the new pre-commit config has no CI validation path.
   .pre-commit-config.yaml is a new tooling/security surface, but no workflow validates it, and web-tests.yml only triggers for apps/web/** or the workflow file itself. Future broken hook IDs, invalid stages, or incompatible revs can merge without automated feedback. Smallest fix: add a lightweight CI job triggered by .pre-commit-config.yaml/ruff.toml that runs pre-commit validate-config and, if intended, pre-commit run --all-files.

No blocking app-runtime findings.

Validation: reviewed the requested diff boundary, parsed .pre-commit-config.yaml successfully with Python YAML, and git diff --check was clean. I could not execute pre-commit or pnpm locally because neither binary is installed in this read-only container. Frontend surface is CI/local tooling only; no rendering boundary or backend contract dependency changed.