From c0a98cf384c8b77db16db11aeb0a68c6af1ea0a1 Mon Sep 17 00:00:00 2001 From: Liakhovskyi Vladyslav Date: Thu, 27 Aug 2026 17:21:15 +0300 Subject: [PATCH 1/3] docs: define tooling and dependency policy AI-Impact: co-developed AI: cx --- TODO | 23 ----------------------- awesome/index.md | 1 + awesome/javascript.md | 6 ++++++ doc.md | 1 + modules/bun/doc.md | 6 ++++-- modules/common/doc.md | 2 ++ modules/go/doc.md | 2 ++ modules/nextjs/doc.md | 9 +++++---- modules/nodejs/doc.md | 27 +++++++++++++++++++++++++++ modules/react/doc.md | 9 +++++---- modules/taskfile/doc.md | 4 ++-- modules/typescript/doc.md | 11 +++++++---- shared/dependency-management.md | 23 +++++++++++++++++++++++ shared/js-biome-bun-core.md | 9 --------- shared/js-biome-core.md | 10 ++++++++++ 15 files changed, 95 insertions(+), 48 deletions(-) create mode 100644 awesome/javascript.md create mode 100644 modules/nodejs/doc.md create mode 100644 shared/dependency-management.md delete mode 100644 shared/js-biome-bun-core.md create mode 100644 shared/js-biome-core.md diff --git a/TODO b/TODO index f673780..c8f4153 100644 --- a/TODO +++ b/TODO @@ -1,25 +1,5 @@ - Add https://github.com/RevoTale/no-js as a required way to do the non complex UI - Maybe replace graphql client gen with gqlgo/gqlgenc -- Dont use synamic variables for the Dockerfile/docker compose versioning to make Renovate and other tool better detect latest version -- Prefer explicit versioning locking (e.g go-1.26.2-trixie over go-1.26) -- Migrate to the https://pnpm.io as a default package manager back because they fix the speed issue by rewriting in RUst on v12 -- add the proper codex devcontainer mounting exmaple -``` -{ - "name": "project", - "image": "mcr.microsoft.com/devcontainers/base:debian-13", - - "remoteUser": "vscode", - - "containerEnv": { - "CODEX_HOME": "/home/vscode/.codex" - }, - - "mounts": [ - "source=codex-home,target=/home/vscode/.codex,type=volume" - ] -} -``` - Add the priority for the techonogies usage for the UI. try to use the pure htmkl first. -> not enoung -> try to achieve it with the html+css -> not enough? -> try to achieve it with html+css + htmx -> not enough? try to achieve it with html+css+htmx+alpine.js->not enough? use NextJs. - Reivew the ability to use pattern when `no-js` global class stylesheet defined: ```templ @@ -39,8 +19,6 @@ css cardRoot() { Example: `class={ DisplayHeading(), cardTitle() }` is preferred over repeating `font-family: var(--font-display)` and the same heading tracking in every card, board, and footer title rule. - I want rules regarding artchitecture, that abstraction should be created as a reusable module, and being deteministic, even if there is littl ebut more code repeated for the same featue. -- https://chatgpt.com/share/69eca650-3328-832e-b017-382f1d3fc5ab -- DO NOT INstall any third party package version younger than 1 week and maintaned not by RevoTale or `l-you` ----- - ## Translation rules - Translate UI copy by meaning and page context, not word-for-word. @@ -48,4 +26,3 @@ css cardRoot() { - For Ukrainian, translate software “utility/utilities” as “інструмент/інструменти” unless the context specifically means a low-level system utility. - Avoid infinitive fragments for section descriptions when the English source implies an active subject. Example: “We are sharing code…” -> “Ми ділимося кодом…”, not “Ділитися кодом…”. - If an English source string is grammatically ambiguous, rewrite the English source first before translating other locales. - diff --git a/awesome/index.md b/awesome/index.md index 6c3d4fd..173218e 100644 --- a/awesome/index.md +++ b/awesome/index.md @@ -9,6 +9,7 @@ Rules: | key | awesome_file | scope | | --- | --- | --- | | go | ./go.md | Go runtime, backend services, Go templating, and Go GraphQL client | +| javascript | ./javascript.md | JavaScript and TypeScript libraries published to npm | | auth | ./auth.md | Authentication, authorization, identity, OAuth2, OIDC, and policy enforcement | | react | ./react.md | React repositories and applications | | nextjs | ./nextjs.md | Next.js repositories and applications | diff --git a/awesome/javascript.md b/awesome/javascript.md new file mode 100644 index 0000000..f2f3c29 --- /dev/null +++ b/awesome/javascript.md @@ -0,0 +1,6 @@ +# Awesome: JavaScript +Enforced utility choices for JavaScript and TypeScript packages. + +| capability | status | package | source | notes | +| --- | --- | --- | --- | --- | +| npm-library-bundler | required | tsdown | https://tsdown.dev/ | Default bundler for TypeScript or JavaScript libraries published to npm. | diff --git a/doc.md b/doc.md index 1f6f404..17d2166 100644 --- a/doc.md +++ b/doc.md @@ -9,6 +9,7 @@ Use this table as the single source of truth for module routing. | --- | --- | --- | --- | | common | Common baseline rules | modules/common/doc.md | always | | taskfile | Taskfile (go-task) workflows | modules/taskfile/doc.md | always | +| nodejs | Node.js runtime and pnpm package manager | modules/nodejs/doc.md | `.node-version`, `.nvmrc`, or `pnpm-lock.yaml` exists, or `package.json` declares Node.js or pnpm tooling | | typescript | TypeScript | modules/typescript/doc.md | `tsconfig.json`, `tsconfig.*.json`, `*.ts`, or `*.tsx` exist | | react | React | modules/react/doc.md | `package.json` includes `react`, or `*.jsx` / `*.tsx` files exist | | nextjs | Next.js | modules/nextjs/doc.md | `next.config.js|mjs|ts`, `package.json` includes `next`, or `app/` route files exist | diff --git a/modules/bun/doc.md b/modules/bun/doc.md index 95a93d3..26f9230 100644 --- a/modules/bun/doc.md +++ b/modules/bun/doc.md @@ -11,8 +11,10 @@ This module defines baseline engineering rules for Bun-based repositories and ap ``` # Strict rules -- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md). +- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md). - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md). +- MUST treat Bun as an explicit alternative to the default Node.js and pnpm stack. +- MUST use Bun only when an existing repository already requires it or maintainers explicitly select it. - MUST use Bun as the only runtime and package manager. - MUST use `bun install` for dependency management. - MUST use `bun run` for project scripts. @@ -22,4 +24,4 @@ This module defines baseline engineering rules for Bun-based repositories and ap # Working Agreements - MUST follow root interaction protocol from [../../AGENTS.md](../../AGENTS.md) before finalizing policy changes. -- MUST ask for explicit `Accept` before allowing non-Bun runtime or package-manager exceptions. +- MUST ask for explicit `Accept` before migrating an existing Bun repository to another runtime or package manager. diff --git a/modules/common/doc.md b/modules/common/doc.md index e34b626..a96a568 100644 --- a/modules/common/doc.md +++ b/modules/common/doc.md @@ -5,11 +5,13 @@ This module defines baseline rules that apply to every repository regardless of ```text / AGENTS.md + renovate.json ``` # Strict rules - MUST reuse Taskfile workflow rules for all projects: [../taskfile/doc.md](../taskfile/doc.md). - MUST follow the organization-wide OS and base image selection policy: [shared/os-and-base-images.md](../../shared/os-and-base-images.md). +- MUST follow the organization-wide dependency and Renovate policy: [shared/dependency-management.md](../../shared/dependency-management.md). - MUST use Taskfile as the default workflow runner across modules. - MUST keep this module scoped to repository-wide baseline rules only; stack-specific rules belong in stack modules. - MUST require `task validate` to pass before merge. diff --git a/modules/go/doc.md b/modules/go/doc.md index e31fe14..ae6a142 100644 --- a/modules/go/doc.md +++ b/modules/go/doc.md @@ -12,6 +12,8 @@ This module defines baseline engineering rules for Go repositories and services. - MUST read enforced utility/library choices from [../../awesome/index.md](../../awesome/index.md), [../../awesome/go.md](../../awesome/go.md), and any matching capability awesome files before introducing, replacing, or removing Go libraries. - MUST enforce `required` entries from matching awesome files for corresponding Go capabilities. - MUST use `golangci-lint` as the Go linter: https://github.com/golangci/golangci-lint. +- MUST use [golangci-lint configuration format](https://golangci-lint.run/docs/configuration/file/) `version: "2"`. +- MUST pin the golangci-lint version in CI and shared development tooling. - MUST enforce a maximum line length of 120 characters through golangci-lint configuration. - SHOULD prefer patterns from `100 Go Mistakes and How to Avoid Them`: https://github.com/teivah/100-go-mistakes. - MUST configure the `lll` linter in golangci-lint with line length set to 120. diff --git a/modules/nextjs/doc.md b/modules/nextjs/doc.md index cce4e99..e2d53dc 100644 --- a/modules/nextjs/doc.md +++ b/modules/nextjs/doc.md @@ -8,19 +8,20 @@ This module defines baseline engineering rules for Next.js repositories and appl app/ next.config.ts biome.json|biome.jsonc - bun.lock|bun.lockb + pnpm-lock.yaml ``` # Strict rules - MUST read enforced utility/library choices from [../../awesome/nextjs.md](../../awesome/nextjs.md) before introducing, replacing, or removing Next.js libraries. - MUST enforce `required` entries from [../../awesome/nextjs.md](../../awesome/nextjs.md) for matching capabilities. - MUST apply React-specific rules from [../react/doc.md](../react/doc.md). -- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md). +- MUST apply the Node.js and pnpm defaults from [../nodejs/doc.md](../nodejs/doc.md) unless a more specific runtime module applies. +- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md). - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md). -- MUST keep Next.js scripts executable through Bun (`bun run next dev`, `bun run next build`, `bun run next start`) because Dockerfile builds depend on them. +- MUST keep Next.js scripts executable through pnpm by default (`pnpm exec next dev`, `pnpm exec next build`, `pnpm exec next start`); a more specific runtime module MAY provide equivalent commands. - SHOULD allow Taskfile workflows to wrap Next.js scripts for repository-level orchestration. - MUST keep `task validate` limited to Biome checks for Next.js repositories. -- MUST keep Bun lockfiles in source control. +- MUST keep `pnpm-lock.yaml` in source control. - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible. - MUST use App Router (`app/`) and MUST NOT introduce `pages/`. - MUST ensure Next.js changes pass `task validate` before merge. diff --git a/modules/nodejs/doc.md b/modules/nodejs/doc.md new file mode 100644 index 0000000..a48ddb6 --- /dev/null +++ b/modules/nodejs/doc.md @@ -0,0 +1,27 @@ +# Overview +This module defines the default Node.js runtime and pnpm package-management rules. + +# Project structure +```text +/ + AGENTS.md + package.json + pnpm-lock.yaml + pnpm-workspace.yaml +``` + +# Strict rules +- MUST read and enforce matching choices from [../../awesome/javascript.md](../../awesome/javascript.md). +- MUST use an [Active LTS Node.js release](https://nodejs.org/en/about/previous-releases) by default. +- MAY use a Maintenance LTS release when compatibility requires it. +- MUST NOT use an end-of-life Node.js release. +- MUST use [pnpm](https://pnpm.io/) as the default package manager and pin its exact version in the `packageManager` field of `package.json`. +- MUST commit `pnpm-lock.yaml` and use a frozen lockfile in CI. +- MUST run package scripts through pnpm and expose repository workflows through Taskfile. +- MUST use `tsdown` for JavaScript or TypeScript libraries published to npm. +- MUST validate publishable npm libraries with `publint`; MUST also use [`attw`](https://tsdown.dev/options/package-validation) when the package publishes TypeScript declarations. +- MUST NOT migrate a working project from another runtime or package manager unless migration is explicitly in scope. + +# Working Agreements +- MUST follow root interaction protocol from [../../AGENTS.md](../../AGENTS.md) before finalizing policy changes. +- MUST request explicit `Accept` before selecting a non-Node.js runtime or non-pnpm package manager for a new JavaScript-family project. diff --git a/modules/react/doc.md b/modules/react/doc.md index 5df30b2..aa496de 100644 --- a/modules/react/doc.md +++ b/modules/react/doc.md @@ -8,19 +8,20 @@ This module defines baseline engineering rules for React repositories and applic package.json src/ biome.json|biome.jsonc - bun.lock|bun.lockb + pnpm-lock.yaml ``` # Strict rules - MUST read enforced utility/library choices from [../../awesome/react.md](../../awesome/react.md) before introducing, replacing, or removing React libraries. - MUST enforce `required` entries from [../../awesome/react.md](../../awesome/react.md) for matching capabilities. -- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md). +- MUST apply the Node.js and pnpm defaults from [../nodejs/doc.md](../nodejs/doc.md) unless a more specific runtime module applies. +- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md). - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md). - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible. -- MUST run React build, test, and development workflows through Bun or Taskfile (if there is some). +- MUST run React build, test, and development workflows through Taskfile and pnpm by default; a more specific runtime module MAY override the package-manager command. - SHOULD define components using functional component patterns. - SHOULD prefer one file per component. -- MUST keep Bun lockfiles in source control. +- MUST keep `pnpm-lock.yaml` in source control. - MUST ensure React changes pass `task validate` before merge. - MUST ensure React changes pass `task test` when the task exists. - SHOULD colocate component-specific helpers with their component when helpers are not shared. diff --git a/modules/taskfile/doc.md b/modules/taskfile/doc.md index 913e1be..7b2b047 100644 --- a/modules/taskfile/doc.md +++ b/modules/taskfile/doc.md @@ -28,7 +28,7 @@ tasks: fix: desc: Auto-fix lint issues cmds: - - bunx biome check --write --unsafe . + - pnpm exec biome check --write --unsafe . ``` Example of correct composition: @@ -38,7 +38,7 @@ tasks: biome:fix: desc: Fix files with Biome cmds: - - bunx biome check --write --unsafe . + - pnpm exec biome check --write --unsafe . fix: desc: Auto-fix all code quality issues cmds: diff --git a/modules/typescript/doc.md b/modules/typescript/doc.md index 25ad81f..3d9fb47 100644 --- a/modules/typescript/doc.md +++ b/modules/typescript/doc.md @@ -8,18 +8,21 @@ This module defines baseline engineering rules for TypeScript repositories and a package.json tsconfig.json|tsconfig.*.json biome.json|biome.jsonc - bun.lock|bun.lockb + pnpm-lock.yaml ``` # Strict rules -- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md). +- MUST read and enforce matching choices from [../../awesome/javascript.md](../../awesome/javascript.md). +- MUST apply the Node.js and pnpm defaults from [../nodejs/doc.md](../nodejs/doc.md) unless a more specific runtime module applies. +- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md). - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md). - MUST keep TypeScript compiler options in `tsconfig.json` or `tsconfig.*.json`. - SHOULD use a single, universal `tsconfig.json` unless tooling requires multiple configs. - MUST configure strict compiler options, including `noUncheckedIndexedAccess`. - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible. -- MUST run scripts and tooling through Bun via Taskfile tasks. -- MUST require `task validate` to include TypeScript typechecking (`bun run tsc --noEmit` or equivalent) and pass before merge. +- MUST use pnpm for scripts and tooling by default; a more specific runtime module MAY override the package-manager command. +- MUST require `task validate` to include TypeScript typechecking (`pnpm exec tsc --noEmit` or the selected runtime's equivalent) and pass before merge. +- MUST generate declaration files for npm libraries that expose TypeScript types. - SHOULD keep TypeScript configuration centralized unless tooling constraints require multiple configs. # Working Agreements diff --git a/shared/dependency-management.md b/shared/dependency-management.md new file mode 100644 index 0000000..6aea5e9 --- /dev/null +++ b/shared/dependency-management.md @@ -0,0 +1,23 @@ +# Overview +This policy defines dependency freshness, Renovate configuration, and directly discoverable container image versions. + +# Strict rules +- MUST NOT install a third-party dependency release until seven days after publication. +- MAY use releases maintained by RevoTale or `l-you` without the seven-day delay. +- MUST obtain explicit user `Accept` and document the reason before any other quarantine exception. +- MUST configure package-manager enforcement when supported. For pnpm, set [`minimumReleaseAge: 10080`](https://pnpm.io/settings/dependency-resolution#minimumreleaseage) in `pnpm-workspace.yaml`; add only verified RevoTale and `l-you` packages or scopes to `minimumReleaseAgeExclude`. +- MUST keep a root `renovate.json` in every target repository with [`extends: ["local>RevoTale/.github:renovate-config"]`](https://docs.renovatebot.com/config-presets/). +- MUST NOT duplicate organization-wide Renovate rules locally without a repository-specific reason. +- MUST write container image tags or digests directly in Dockerfiles, Compose files, devcontainer configuration, and CI configuration so standard dependency managers can discover them. +- MUST prefer the most specific supported image tag or digest instead of a floating tag. +- MUST NOT hide container image versions behind build arguments or environment variables. +- MUST NOT add custom Renovate managers or annotations solely to update an indirect container image version. + +Use this minimal target-repository configuration: + +```json +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["local>RevoTale/.github:renovate-config"] +} +``` diff --git a/shared/js-biome-bun-core.md b/shared/js-biome-bun-core.md deleted file mode 100644 index a8ce1e0..0000000 --- a/shared/js-biome-bun-core.md +++ /dev/null @@ -1,9 +0,0 @@ -# Overview -Reusable baseline rules for JavaScript-family stacks that use Bun and Biome. - -# Core Behaviors & Patterns -- Use Biome as the linter and formatter: https://github.com/biomejs/biome -- Use Biome `recommended` defaults as the baseline configuration. -- Enable all Biome features that fit the current project scope. -- Node.js usage is forbidden; use Bun only: https://github.com/oven-sh/bun -- ESLint and Prettier are forbidden. diff --git a/shared/js-biome-core.md b/shared/js-biome-core.md new file mode 100644 index 0000000..8e3c6a5 --- /dev/null +++ b/shared/js-biome-core.md @@ -0,0 +1,10 @@ +# Overview +Reusable Biome baseline for JavaScript-family stacks. + +# Core Behaviors & Patterns +- MUST use Biome as the linter and formatter: https://biomejs.dev/. +- MUST set `linter.rules.preset` to `all` so every stable rule is enabled. +- MUST NOT enable nursery rules globally because they are not covered by Biome semantic-versioning guarantees. +- MUST make Biome warnings fail validation, for example with `biome check --error-on-warnings .`. +- MUST keep suppressions local and explain why the rule does not apply. +- MUST NOT use ESLint or Prettier. From 20616a59af06aec34c032f3531c096e8704a080f Mon Sep 17 00:00:00 2001 From: Liakhovskyi Vladyslav Date: Thu, 27 Aug 2026 17:48:17 +0300 Subject: [PATCH 2/3] docs: clarify version and dependency policies Align package-manager pins with Renovate support and make runtime, quarantine, and image pinning rules deterministic. AI-Impact: co-developed AI: cx --- modules/go/doc.md | 2 +- modules/nextjs/doc.md | 2 +- modules/nodejs/doc.md | 3 ++- modules/react/doc.md | 2 +- shared/dependency-management.md | 4 ++-- 5 files changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/go/doc.md b/modules/go/doc.md index ae6a142..50ff068 100644 --- a/modules/go/doc.md +++ b/modules/go/doc.md @@ -12,7 +12,7 @@ This module defines baseline engineering rules for Go repositories and services. - MUST read enforced utility/library choices from [../../awesome/index.md](../../awesome/index.md), [../../awesome/go.md](../../awesome/go.md), and any matching capability awesome files before introducing, replacing, or removing Go libraries. - MUST enforce `required` entries from matching awesome files for corresponding Go capabilities. - MUST use `golangci-lint` as the Go linter: https://github.com/golangci/golangci-lint. -- MUST use [golangci-lint configuration format](https://golangci-lint.run/docs/configuration/file/) `version: "2"`. +- MUST use the latest [golangci-lint configuration format](https://golangci-lint.run/docs/configuration/file/) supported by the pinned golangci-lint version. - MUST pin the golangci-lint version in CI and shared development tooling. - MUST enforce a maximum line length of 120 characters through golangci-lint configuration. - SHOULD prefer patterns from `100 Go Mistakes and How to Avoid Them`: https://github.com/teivah/100-go-mistakes. diff --git a/modules/nextjs/doc.md b/modules/nextjs/doc.md index e2d53dc..d56ff77 100644 --- a/modules/nextjs/doc.md +++ b/modules/nextjs/doc.md @@ -21,7 +21,7 @@ This module defines baseline engineering rules for Next.js repositories and appl - MUST keep Next.js scripts executable through pnpm by default (`pnpm exec next dev`, `pnpm exec next build`, `pnpm exec next start`); a more specific runtime module MAY provide equivalent commands. - SHOULD allow Taskfile workflows to wrap Next.js scripts for repository-level orchestration. - MUST keep `task validate` limited to Biome checks for Next.js repositories. -- MUST keep `pnpm-lock.yaml` in source control. +- MUST keep the selected package manager's lockfile in source control; use `pnpm-lock.yaml` for the default pnpm stack. - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible. - MUST use App Router (`app/`) and MUST NOT introduce `pages/`. - MUST ensure Next.js changes pass `task validate` before merge. diff --git a/modules/nodejs/doc.md b/modules/nodejs/doc.md index a48ddb6..bcbe5ee 100644 --- a/modules/nodejs/doc.md +++ b/modules/nodejs/doc.md @@ -15,7 +15,8 @@ This module defines the default Node.js runtime and pnpm package-management rule - MUST use an [Active LTS Node.js release](https://nodejs.org/en/about/previous-releases) by default. - MAY use a Maintenance LTS release when compatibility requires it. - MUST NOT use an end-of-life Node.js release. -- MUST use [pnpm](https://pnpm.io/) as the default package manager and pin its exact version in the `packageManager` field of `package.json`. +- MUST use [pnpm](https://pnpm.io/) as the default package manager and pin its exact version in a `package.json` field natively managed by Renovate. +- MUST use the top-level [`packageManager`](https://docs.renovatebot.com/modules/manager/npm/) field until Renovate natively manages pnpm's preferred [`devEngines.packageManager`](https://pnpm.io/package_json#devenginespackagemanager) field. - MUST commit `pnpm-lock.yaml` and use a frozen lockfile in CI. - MUST run package scripts through pnpm and expose repository workflows through Taskfile. - MUST use `tsdown` for JavaScript or TypeScript libraries published to npm. diff --git a/modules/react/doc.md b/modules/react/doc.md index aa496de..2c6980b 100644 --- a/modules/react/doc.md +++ b/modules/react/doc.md @@ -21,7 +21,7 @@ This module defines baseline engineering rules for React repositories and applic - MUST run React build, test, and development workflows through Taskfile and pnpm by default; a more specific runtime module MAY override the package-manager command. - SHOULD define components using functional component patterns. - SHOULD prefer one file per component. -- MUST keep `pnpm-lock.yaml` in source control. +- MUST keep the selected package manager's lockfile in source control; use `pnpm-lock.yaml` for the default pnpm stack. - MUST ensure React changes pass `task validate` before merge. - MUST ensure React changes pass `task test` when the task exists. - SHOULD colocate component-specific helpers with their component when helpers are not shared. diff --git a/shared/dependency-management.md b/shared/dependency-management.md index 6aea5e9..a2adc94 100644 --- a/shared/dependency-management.md +++ b/shared/dependency-management.md @@ -5,11 +5,11 @@ This policy defines dependency freshness, Renovate configuration, and directly d - MUST NOT install a third-party dependency release until seven days after publication. - MAY use releases maintained by RevoTale or `l-you` without the seven-day delay. - MUST obtain explicit user `Accept` and document the reason before any other quarantine exception. -- MUST configure package-manager enforcement when supported. For pnpm, set [`minimumReleaseAge: 10080`](https://pnpm.io/settings/dependency-resolution#minimumreleaseage) in `pnpm-workspace.yaml`; add only verified RevoTale and `l-you` packages or scopes to `minimumReleaseAgeExclude`. +- MUST configure package-manager enforcement when supported. For pnpm, set [`minimumReleaseAge: 10080`](https://pnpm.io/settings/dependency-resolution#minimumreleaseage) and `minimumReleaseAgeIgnoreMissingTime: false` in `pnpm-workspace.yaml`; add only verified RevoTale and `l-you` packages or scopes to `minimumReleaseAgeExclude`. - MUST keep a root `renovate.json` in every target repository with [`extends: ["local>RevoTale/.github:renovate-config"]`](https://docs.renovatebot.com/config-presets/). - MUST NOT duplicate organization-wide Renovate rules locally without a repository-specific reason. - MUST write container image tags or digests directly in Dockerfiles, Compose files, devcontainer configuration, and CI configuration so standard dependency managers can discover them. -- MUST prefer the most specific supported image tag or digest instead of a floating tag. +- MUST prefer the most specific supported image tag with its digest instead of a floating tag, for example `:1.2.3@sha256:`. - MUST NOT hide container image versions behind build arguments or environment variables. - MUST NOT add custom Renovate managers or annotations solely to update an indirect container image version. From c091b7e1984feb30bac234e4ccca7aa04fa352fa Mon Sep 17 00:00:00 2001 From: Liakhovskyi Vladyslav Date: Thu, 27 Aug 2026 19:00:18 +0300 Subject: [PATCH 3/3] docs: prefer Current Node.js releases Use supported LTS releases when Current compatibility or production stability requires it. AI-Impact: co-developed AI: cx --- modules/nodejs/doc.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/nodejs/doc.md b/modules/nodejs/doc.md index bcbe5ee..af9aeef 100644 --- a/modules/nodejs/doc.md +++ b/modules/nodejs/doc.md @@ -12,8 +12,8 @@ This module defines the default Node.js runtime and pnpm package-management rule # Strict rules - MUST read and enforce matching choices from [../../awesome/javascript.md](../../awesome/javascript.md). -- MUST use an [Active LTS Node.js release](https://nodejs.org/en/about/previous-releases) by default. -- MAY use a Maintenance LTS release when compatibility requires it. +- MUST prefer the [Current Node.js release](https://nodejs.org/en/about/previous-releases) when project dependencies, tooling, and runtime environments support it. +- MUST use a supported LTS release when Current compatibility is not established or production stability requirements favor LTS. - MUST NOT use an end-of-life Node.js release. - MUST use [pnpm](https://pnpm.io/) as the default package manager and pin its exact version in a `package.json` field natively managed by Renovate. - MUST use the top-level [`packageManager`](https://docs.renovatebot.com/modules/manager/npm/) field until Renovate natively manages pnpm's preferred [`devEngines.packageManager`](https://pnpm.io/package_json#devenginespackagemanager) field.