chore: block new problems from being added to the suppressions files

[cryptodev-2s]

Explanation

lint:oxlint and lint:tsc:check stop new problems from landing, but both have an escape hatch: regenerating their suppressions file. That parks a problem instead of fixing it.

lint:suppressions closes it. Measured against the base branch, oxlint-suppressions.json and tsc-suppressions.json may only shrink:

• removing a suppression, or lowering its count, passes
• adding one, or raising a count, fails

The comparison is per file and per rule, so deletions never offset an addition.

CI checks a pull request out as the merge into its base, so the baseline is the first parent and there is nothing extra to fetch. Outside CI there is no merge commit, so pass a ref: yarn lint:suppressions origin/main.

Bypass

The allow-new-suppressions label skips the job, for when suppressions genuinely have to be added (a new package, mostly). It needs creating, and longer term this should be a Core Platform approval rather than a label anyone can apply.

The Oxlint config change

Tests under scripts/ have to import { jest } from '@jest/globals', as Jest does not inject it in ESM, and no-shadow flagged every one. Left alone, every new script test would arrive with a fresh suppression and fail this check. Allowing that one name removes 41 lines from oxlint-suppressions.json.

Worth knowing

The check is strict, per file and per rule. A type error that moves between files, or a rename that rewrites paths, reads as an addition in one file and a removal in the other, so it wants fixing rather than re-suppressing.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Changes are limited to CI and repo lint tooling; no runtime product behavior, though PRs that legitimately need new suppressions must use the bypass label until approval flows exist.

Overview
Adds a lint:suppressions check (and yarn lint:suppressions) that fails when oxlint-suppressions.json or tsc-suppressions.json grow relative to the base branch—new file/rule entries or higher per-rule counts are rejected; shrinking or removing suppressions still passes. Baselines come from HEAD^1 in GitHub Actions and from git merge-base locally (default origin/main).

A new Lint Suppressions workflow runs that check on pull requests (re-running on label changes) and can be skipped with the allow-new-suppressions label; it also asserts a clean working tree after the job.

Oxlint now allows jest in no-shadow for scripts/**/*.test.ts, which removes a batch of script-test suppressions that would otherwise trip the new gate. lint-tsc scripts drop --experimental-strip-types, and SUPPRESSIONS_FILE_NAME is shared from tsc-suppressions.ts for the new checker and tests.

^{Reviewed by Cursor Bugbot for commit 89fa89f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Mrtenz]

We occasionally do need to add new lint suppressions, e.g., when updating the Oxlint configs, in which case we need to be able to bypass this check.

Mark suggested allowing it if the pull request is approved by the Core Platform team, which sounds like a good idea to me.

[cryptodev-2s]

Good catch, I forgot we had a discussion about this during last retro

[cryptodev-2s]

@Mrtenz as this PR scope already grow do you think I can do a follow up on this ? otherwise is a label enough ?

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 39074d1. Configure here.}