todo: move TypeScript to CI toolchain - #1770

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe3ce8979e

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a45429d8e4

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5011559b00

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 421889226e

Approved.

Premise checks out on main: devDependencies holds typescript: =7.0.2 alongside @types/node: =26.0.0, so every npm ci does install the compiler including in jobs that never run it.

The task list also gets right the thing that would have been easy to miss. #1767 had just made package-check read its pin from package.json's devDependencies — which is precisely what this task proposes to delete — and the second checkbox names that dependency explicitly rather than discovering it later. Worth saying why that ordering matters: #1767 closed a finding where the pin existed in two unlinked places and drift between them was silent at both the proof layer and CI. Moving the pin to CI config while removing it from package.json keeps one source of truth; doing only the first half would put the two copies back. The note has it in the right order.

Status open, priority P3, both valid. Todo-only, so no changelog per changelog/README.md.

I checked the premise and that ordering; I did not verify each of the twelve tasks is individually implementable — several depend on runner and publishing behaviour I cannot exercise here.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49342061cf

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85f3780796

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f6a120c840

Approved. All three referenced notes resolve.

The package-check clause is the part worth having, and it protects exactly the right property. That job's whole value is that it sees only what a consumer sees — no checkout, no repository tsconfig.json, no node_modules. Reaching a relative flake by exposing the repository to it would keep the job green while quietly making it a different job. Saying so up front, with an explicit fallback to pinned PATH provisioning if Nix cannot supply the compiler without that access, is better than discovering it during the migration.

Preferring Nix before PATH workarounds, and coordinating the publish path with the workflow that owns its generation, both read as sensible sequencing rather than deferral.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d720fde29a

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9c82206782

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9bf6576dc6

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5ff63d065

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c50bf04a2

Approved. The version-check requirement is the right addition, and it guards a real hazard rather than a hypothetical one: a globally installed compiler is shared across checkouts, so the pin belongs to the checkout while the tool does not. Requiring repository-owned checks to compare the available tsc against the current checkout's CI pin, fail fast, and print the exact install command turns a silent wrong-compiler run into a loud one.

That is the same shape as the finding I raised on #1767 — a value existing in two places with nothing comparing them — carried forward to the case where the second copy is on the developer's machine rather than in a config file. The explicit "switching between checkouts with different pins must not silently use the wrong compiler" verification task is the part that would actually catch it.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6504137911