improvement(audits): make baseline updates shrink-only and tolerate biome diagnostic exit codes

Author: waleedlatif1

scripts/check-explicit-any.ts

@@ -17,7 +17,7 @@
  *
  * Run: `bun run check:explicit-any`
  */
-import { readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { localBin } from './local-bin'
 
@@ -56,7 +56,8 @@ function collect(): Baseline {
     ],
     { cwd: ROOT, stdout: 'pipe', stderr: 'pipe' }
   )
-  if (result.exitCode !== 0) {
+  // Hits are reported as diagnostics, so only a run that produced none counts as a failure.
+  if (result.exitCode !== 0 && !result.stdout.toString().includes('::')) {
     console.error(`biome lint failed:\n${result.stderr.toString()}`)
     process.exit(1)
   }
@@ -86,21 +87,44 @@ function total(counts: Counts): number {
 }
 
 const current = collect()
+const baseline: Baseline = existsSync(BASELINE)
+  ? (JSON.parse(readFileSync(BASELINE, 'utf8')) as Baseline)
+  : current
+
+/** Per-file counts clamped to the baseline, so an update can only lower them. */
+function shrunkTo(after: Counts, before: Counts): Counts {
+  return Object.fromEntries(
+    Object.entries(after)
+      .map(([file, count]): [string, number] => [file, Math.min(count, before[file] ?? 0)])
+      .filter(([, count]) => count > 0)
+  )
+}
 
 if (process.argv.includes('--update')) {
-  const baseline: Baseline = {
-    explicitAny: sorted(current.explicitAny),
-    nonNullAssertion: sorted(current.nonNullAssertion),
+  const next: Baseline = {
+    explicitAny: sorted(shrunkTo(current.explicitAny, baseline.explicitAny ?? {})),
+    nonNullAssertion: sorted(shrunkTo(current.nonNullAssertion, baseline.nonNullAssertion ?? {})),
   }
-  writeFileSync(BASELINE, `${JSON.stringify(baseline, null, 2)}\n`)
+  writeFileSync(BASELINE, `${JSON.stringify(next, null, 2)}\n`)
   console.log(
-    `Wrote ${path.relative(ROOT, BASELINE)}: ${total(baseline.explicitAny)} explicit any, ` +
-      `${total(baseline.nonNullAssertion)} non-null assertions`
+    `Wrote ${path.relative(ROOT, BASELINE)}: ${total(next.explicitAny)} explicit any, ` +
+      `${total(next.nonNullAssertion)} non-null assertions`
+  )
+  const raised = (Object.keys(METRICS) as Metric[]).flatMap((metric) =>
+    Object.entries(current[metric])
+      .filter(([file, count]) => count > (baseline[metric]?.[file] ?? 0))
+      .map(
+        ([file, count]) =>
+          `  ${metric} ${file}: ${count} (baseline ${baseline[metric]?.[file] ?? 0})`
+      )
   )
-  process.exit(0)
+  if (raised.length) {
+    console.error(`✗ refused to raise the baseline for ${raised.length} file(s); fix them instead:`)
+    console.error(raised.sort().join('\n'))
+  }
+  process.exit(raised.length ? 1 : 0)
 }
 
-const baseline = JSON.parse(readFileSync(BASELINE, 'utf8')) as Baseline
 let regressed = 0
 let stale = 0
 

scripts/check-file-names.ts

@@ -34,7 +34,7 @@
  * Run: `bun run check:file-names`
  */
 import { execFileSync } from 'node:child_process'
-import { readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 
 const ROOT = path.resolve(import.meta.dir, '..')
@@ -187,14 +187,23 @@ const violations = sourceFiles().flatMap(check)
 const byKey = new Map(violations.map((violation) => [key(violation), violation]))
 const current = [...byKey.keys()].sort()
 
+const baseline = new Set<string>(
+  existsSync(BASELINE) ? JSON.parse(readFileSync(BASELINE, 'utf8')) : current
+)
+const added = current.filter((entry) => !baseline.has(entry))
+
 if (process.argv.includes('--update')) {
-  writeFileSync(BASELINE, `${JSON.stringify(current, null, 2)}\n`)
-  console.log(`Wrote ${current.length} baseline entries to ${path.relative(ROOT, BASELINE)}`)
-  process.exit(0)
+  // Shrink-only: drop fixed entries, never admit a new one.
+  const kept = current.filter((entry) => baseline.has(entry))
+  writeFileSync(BASELINE, `${JSON.stringify(kept, null, 2)}\n`)
+  console.log(`Wrote ${kept.length} baseline entries to ${path.relative(ROOT, BASELINE)}`)
+  for (const entry of added) {
+    const violation = byKey.get(entry) as Violation
+    console.error(`✗ not baselined — rename: ${violation.file} → ${violation.expected}`)
+  }
+  process.exit(added.length ? 1 : 0)
 }
 
-const baseline = new Set<string>(JSON.parse(readFileSync(BASELINE, 'utf8')))
-const added = current.filter((entry) => !baseline.has(entry))
 const currentSet = new Set(current)
 const stale = [...baseline].filter((entry) => !currentSet.has(entry))
 

scripts/check-unused-exports.ts

@@ -24,7 +24,7 @@
  *
  * Run: `bun run check:unused-exports`
  */
-import { readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { localBin } from './local-bin'
 
@@ -112,14 +112,23 @@ if (strict.length) {
 
 const current = [...kindByEntry.keys()].sort()
 
+const baseline = new Set<string>(
+  existsSync(BASELINE) ? JSON.parse(readFileSync(BASELINE, 'utf8')) : current
+)
+const added = current.filter((entry) => !baseline.has(entry))
+
 if (process.argv.includes('--update')) {
-  writeFileSync(BASELINE, `${JSON.stringify(current, null, 2)}\n`)
-  console.log(`Wrote ${current.length} baseline entries to ${path.relative(ROOT, BASELINE)}`)
-  process.exit(strict.length ? 1 : 0)
+  // Shrink-only: drop fixed entries, never admit a new one.
+  const kept = current.filter((entry) => baseline.has(entry))
+  writeFileSync(BASELINE, `${JSON.stringify(kept, null, 2)}\n`)
+  console.log(`Wrote ${kept.length} baseline entries to ${path.relative(ROOT, BASELINE)}`)
+  if (added.length) {
+    console.error(`✗ refused to baseline ${added.length} new unused export(s); fix them instead:`)
+    for (const entry of added) console.error(`  ${entry}`)
+  }
+  process.exit(strict.length || added.length ? 1 : 0)
 }
 
-const baseline = new Set<string>(JSON.parse(readFileSync(BASELINE, 'utf8')))
-const added = current.filter((entry) => !baseline.has(entry))
 const currentSet = new Set(current)
 const stale = [...baseline].filter((entry) => !currentSet.has(entry))