* feat(action): expose --annotations through action.yml
Adds an opt-in 'annotations' input to the composite action so users
can surface findings as inline GitHub Actions annotations on the PR's
Files changed view. The flag is forwarded to the CLI as --annotations.
When 'github-token' is also set, the captured PR-comment body now
filters out '::error' / '::warning' workflow-command lines so the
sticky summary stays human-readable while the runner still parses
annotations from the live step log.
README documents the three resulting modes: sticky-comment-only
(default), annotations-only, and both.
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
* docs: tighten action annotations docs, remove em dashes
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
* test(action): update contract test for split tee/sed and annotations
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
* docs: remove stale dead-code claims after Knip removal (#246)
PR #246 removed the bundled knip integration, but several user-facing
docs still advertised dead-code coverage and exposed the removed
`--dead-code` / `--no-dead-code` CLI flags:
- packages/react-doctor/README.md ("and dead code" in the categories list)
- skills/react-doctor/SKILL.md (skill description)
- packages/website/public/llms.txt (CLI options block)
Strips those claims and adds a short migration note pointing users to
`npx knip` directly for dead-code analysis.
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
* chore(todos): mark stale dead-code doc cleanup as resolved
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
Builds the AST-only foundation needed to port the 8 rules from
eslint-plugin-react-you-might-not-need-an-effect (NickvanDyke,
v0.10.1, upstream SHA 4c71faaa7623d2d5feb33983dc2ebcc08206bcc5).
Upstream is ESLint-native and uses context.sourceCode.getScope()
references / resolved.defs[].node.init recursively to chase the
ultimate source of every value. Oxlint plugins have no scope
manager. This commit ports the impedance-bridging analyzer:
- get-effect-deps-array.ts: typed accessor for useEffect(..., deps)
- has-effect-cleanup.ts: matches upstream's loose hasCleanup shape
- is-custom-hook-name.ts: `use[A-Z]` predicate
- is-synchronous.ts: parent-pointer walk bailing on await / void /
nested function-likes
- get-containing-component-or-hook.ts: classifies the surrounding
function as component / HOC-wrapped component / custom hook
(mirrors upstream's pure-HOC short-circuit for memo/forwardRef)
- collect-use-ref-bindings.ts: top-level useRef binding collector
- collect-local-function-bindings.ts: FunctionDeclaration / arrow /
useCallback bindings with param names + body for indirect-call
reasoning
- analyze-component-bindings.ts: the cornerstone — classifies every
component-scope name as state / setter / ref / prop / constant /
local-function and precomputes localFunctionCalls{StateSetter,
PropFunction,RefMethod} flags so callees like setX(...) inside an
intermediateSetter() still register as state-setter calls
- classify-effect-callee-argument.ts: leaf / transitive upstream
classification used by every rule for argument and deps analysis
- stringify-expression-snippet.ts: bounded AST → text formatter for
the no-initialize-state "set to ..." message
- create-effect-analyzer-tracker.ts: function-entry / -exit visitor
pair that maintains the ComponentBindingTable stack
Plus rules/state-and-effects/effect/SOURCE.md with upstream commit
SHA, license attribution, and known divergences.
Co-authored-by: Aiden Bai <aidenybai@users.noreply.github.com>
* fix: scope client secret diagnostics
Avoid reporting weak secret-name heuristics in config and tooling files, and render framework-specific public env guidance so non-Next.js projects get actionable output.
* fix: broaden secret false-positive guards
Extend the weak client-secret heuristic boundary to common server and tooling paths while keeping exact secret-shape detection active, and move recommendation helpers into focused utilities.
* fix: tighten rc file secret heuristic
Require rc config filenames to be explicit so normal source files like src.ts still use the weak secret-name heuristic.
* test: cover explicit rc secret heuristic
Add regression coverage that explicit rc config files remain outside the weak client-secret name heuristic while regular src.ts files still report.
* fix: refine secret heuristic boundaries
Keep client API helpers covered while making the server-only heuristic exclusions easier to audit.
* chore: format TODO tracker
Format the inherited TODO tracker so PR merge-commit checks can pass.
* fix: classify client secret exposure
Gate the weak secret-name heuristic on explicit client exposure while keeping high-confidence secret values active everywhere.
* test: cover secret exposure boundaries
Lock down client, server, ambiguous-source, and App Router cases for the client-secret heuristic.
* fix: pass framework to secret classifier
Use detected framework settings to avoid path-only client exposure guesses for app directories and server-owned source roots.
* fix: respect use server in secret classifier
Classify use-server modules as server code so client-path heuristics do not report server action constants.
* fix: harden secret exposure edges
Cover mixed server-only scopes, server-owned source roots, and additional client entry shapes so the weak secret heuristic stays scoped to bundled client code.
* fix: refine secret classifier precedence
Classify secret exposure from project-relative paths and gate Next-only route heuristics so explicit client signals win over broad server path names.
* fix: suppress secret label false positives
Avoid weak secret-name diagnostics for UI copy and storage-key prefixes found during evals while preserving client secret fallback coverage.
* fix: preserve api key secret detection
Keep camel-case apiKey variables eligible for the weak secret heuristic while retaining UI text and storage prefix suppressions.
* chore: format changeset prerelease metadata
Keep the new prerelease metadata from main aligned with the repository formatter so CI can pass on the PR merge commit.
Aiden Bai