CI: git hooks, bun run ci, turbo cache, cli-smoke heap cap

[wass08]

What does this PR do?

Stops the push → red CI → fix → push loop on editor PRs. Of the last 10 failed CI runs:

• at least 5 were type errors or failing tests that were never run locally (the repo had no git hooks)
• 3 were the cli-smoke build running out of Node heap on the 7 GB macOS runner
• 2 were type errors from git-installed plugin packages

Git hooks (.githooks/, wired by postinstall via core.hooksPath)

• pre-commit runs Biome on staged files, fixes what it can and blocks on the rest.

• pre-push:

  1. checks bun.lock is in sync, when a package.json or the lockfile changed
  2. runs lint (bun run check)
  3. runs check-types and tests for the packages the branch changes and their dependents

  The worst case is a core change, about 33 s. Skip once with --no-verify.

• The hooks are plain bash (runs on macOS's bash 3.2) and call bun run scripts, so they also work when editor is a submodule of pascalorg/private-editor. The private repo's install points the submodule at .githooks.

• postinstall does nothing in CI or when there is no .git (Docker).

bun run ci runs exactly what the quality job runs: check, skills:validate, check-types, test, build. CONTRIBUTING now points to it.

CI

• Turbo remote cache backed by the Actions cache (rharkor/caching-for-turbo, SHA-pinned) in both jobs. Unchanged packages replay instead of rerunning.
• setup-bun reads packageManager instead of a second hard-coded pin.
• cli-smoke: NODE_OPTIONS=--max-old-space-size=5120. Recent runs hit "Reached heap limit" and exit 137.

How to test

1. bun install, then git config core.hooksPath prints .githooks.
2. Stage a file with a lint error and commit: the commit is blocked. Unsorted imports get fixed and restaged.
3. bun run ci passes. Validated from a clean worktree with CI=1 bun install --frozen-lockfile in 4.2 min: lint, skills, types 11/11, tests 13/13, build 8/8.
4. This push went through the new pre-push hook.

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

🤖 Generated with Claude Code

https://claude.ai/code/session_01VMczFMfWJtZDbBdTARy88m

---

Note

Low Risk
Changes affect dev tooling and CI only; no runtime product, auth, or data-path changes.

Overview
Adds local guardrails so contributors catch the same failures CI sees before push. bun install sets core.hooksPath to .githooks/ (skipped in CI and non-git installs): pre-commit runs Biome with --write on staged JS/TS/CSS/JSON/Markdown and re-stages fixes; pre-push optionally verifies bun.lock when deps changed, runs full check, then ci:changed (turbo run check-types test with a ...[$merge-base] filter) for affected packages.

Root bun run ci mirrors the quality job (check, skills validation, types, tests, build). CONTRIBUTING now recommends bun run ci instead of separate check + test.

GitHub Actions: both jobs read Bun from packageManager via bun-version-file, add Turbo cache (caching-for-turbo, SHA-pinned), and cli-smoke sets NODE_OPTIONS=--max-old-space-size=5120 to avoid editor build OOM on macOS runners.

^{Reviewed by Cursor Bugbot for commit 55f8f71. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 3da01ee5-991c-439e-a079-c0af50dea257

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 55f8f71. Configure here.}

[cursor]

Lockfile check sees working tree

Medium Severity

The lockfile gate runs bun install --frozen-lockfile --dry-run against the working tree, not the commits being pushed. After a local bun install, an uncommitted bun.lock keeps the check green even when the branch still has a stale lockfile, which is the case this hook is meant to stop.

 

^{Reviewed by Cursor Bugbot for commit 55f8f71. Configure here.}

[cursor]

Pre-commit restages unstaged edits

Low Severity

After Biome --write, the hook git adds every staged path it selected. Unstaged hunks in those same files, including leftover WIP or secrets, get pulled into the commit along with the formatter fixes.

 

^{Reviewed by Cursor Bugbot for commit 55f8f71. Configure here.}