Background
PR #555 added knip.jsonc for ad-hoc dead-code analysis (run via npx knip), but intentionally did not wire knip into CI. The reason: this repo SHA-pins all GitHub Actions workflow steps, and adding an unpinned npx knip invocation would be a supply-chain regression.
Tracking comment: #555 (comment)
Decision needed
A maintainer decision is required on whether to add knip as a pinned devDependency (with a full lockfile entry and defined upgrade cadence).
Planned follow-up (once the decision lands)
- Add knip as a devDependency — pin to the current validated version (6.16.1) and update
package-lock.json.
- Add an npm script in
package.json:
- Add a non-concurrent CI step in the relevant workflow(s) — must run before any step that mutates
dist/ (i.e., before the build step) to avoid races with dist writes. Use npm run knip (windows-safe, no bare glob expansion).
- Extend
test/ci-workflows.test.ts (see test/ci-workflows.test.ts:39-50 and test/ci-workflows.test.ts:63-81) to assert the knip script is invoked in both the linux validate job and the windows scripts-windows expectations.
References
Background
PR #555 added
knip.jsoncfor ad-hoc dead-code analysis (run vianpx knip), but intentionally did not wire knip into CI. The reason: this repo SHA-pins all GitHub Actions workflow steps, and adding an unpinnednpx knipinvocation would be a supply-chain regression.Tracking comment: #555 (comment)
Decision needed
A maintainer decision is required on whether to add
knipas a pinneddevDependency(with a full lockfile entry and defined upgrade cadence).Planned follow-up (once the decision lands)
package-lock.json.package.json:dist/(i.e., before thebuildstep) to avoid races with dist writes. Usenpm run knip(windows-safe, no bare glob expansion).test/ci-workflows.test.ts(seetest/ci-workflows.test.ts:39-50andtest/ci-workflows.test.ts:63-81) to assert theknipscript is invoked in both the linuxvalidatejob and the windowsscripts-windowsexpectations.References
knip.jsoncconfigtest/ci-workflows.test.ts— existing CI regression guard.github/workflows/— workflow files to update