fix(ci): align staged checks with Vite+ (#40774)

.github/linters/.yaml-lint.yml

@@ -4,6 +4,8 @@ extends: default
 rules:
   brackets:
     max-spaces-inside: 1
+  comments:
+    min-spaces-from-content: 1
   comments-indentation: disable
   document-start: disable
   line-length: disable

.github/pull_request_template.md

@@ -21,4 +21,4 @@
 - [ ] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
 - [ ] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
 - [ ] I've updated the documentation accordingly.
-- [ ] I ran `make lint && make type-check` (backend) and `cd web && pnpm exec vp staged` (frontend) to appease the lint gods
+- [ ] I ran `make lint && make type-check` (backend) and `vp staged` (frontend) to appease the lint gods

.github/workflows/autofix.yml

@@ -50,6 +50,8 @@ jobs:
             vite.config.ts
             lint.config.ts
             eslint.config.mjs
+            knip.config.ts
+            scripts/check-web-production-unused-after-knip-fix.mjs
             oxlint-suppressions.json
             eslint-suppressions.json
             .vscode/**

.github/workflows/style.yml

@@ -174,6 +174,8 @@ jobs:
             vite.config.ts
             lint.config.ts
             eslint.config.mjs
+            knip.config.ts
+            scripts/check-web-production-unused-after-knip-fix.mjs
             oxlint-suppressions.json
             eslint-suppressions.json
             .vscode/**
@@ -210,6 +212,7 @@ jobs:
             **Dockerfile
             dev/**
             .editorconfig
+            .vite-hooks/**
 
       - name: Super-linter
         uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
@@ -218,10 +221,11 @@ jobs:
           BASH_SEVERITY: warning
           DEFAULT_BRANCH: origin/main
           EDITORCONFIG_FILE_NAME: editorconfig-checker.json
-          FILTER_REGEX_INCLUDE: pnpm-lock.yaml
+          ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           IGNORE_GENERATED_FILES: true
           IGNORE_GITIGNORED_FILES: true
+          VALIDATE_ALL_CODEBASE: false
           VALIDATE_BASH: true
           VALIDATE_BASH_EXEC: true
           # FIXME: temporarily disabled until api-docker.yaml's run script is fixed for shellcheck

.vite-hooks/pre-commit

@@ -5,7 +5,6 @@ files=$(git diff --cached --name-only)
 # check if api or web directory is modified
 
 api_modified=false
-web_modified=false
 skip_web_checks=false
 
 git_path() {
@@ -29,10 +28,6 @@ do
             # set api_modified flag to true
             api_modified=true
             ;;
-        web/*)
-            # set web_modified flag to true
-            web_modified=true
-            ;;
     esac
 done
 

RESOURCE_BOUNDARY_CHANGE_GUIDE.md

@@ -1,12 +0,0 @@
-# Resource Boundary Change Guide
-
-- Resolve the tenant-scoped parent at the request boundary, then pass the validated model, owner reference, and actor downstream.
-- Put the complete owner tuple in the database query; do not load by a bare ID and check ownership afterward.
-- Treat missing and foreign-owned resources alike as `404` before locks, rate limits, tasks, plugin calls, network calls, or writes.
-- Reuse existing owner resolvers and trusted objects instead of adding parallel helpers or refetching the same resource.
-- Pass tenant, actor, and session explicitly; authenticated code must not depend on ambient account or tenant fallbacks.
-- Raise typed domain errors in services and translate them to HTTP errors in controllers; reserve `ValueError` for invalid values or state.
-- Let RBAC own authorization when enabled, and run legacy dataset permission checks only when RBAC is disabled.
-- Preserve successful HTTP responses and shared runtime contracts, especially Celery task names and argument shapes during rolling upgrades.
-- Keep runtime validation and OpenAPI schemas aligned, then regenerate Markdown and TypeScript contracts after schema changes.
-- Prove the boundary with a foreign-owner decoy and assert that rejected requests trigger no downstream side effects.

lint.config.ts

@@ -138,7 +138,8 @@ export const lintConfig = {
     'dify-agent/**',
     'docker/**',
     'docs/**',
-    'scripts/**',
+    'scripts/**/*',
+    '!scripts/check-web-production-unused-after-knip-fix.mjs',
     'sdks/php-client/**',
     'sdks/python-client/**',
     '**/.next/**',

vite.config.ts

@@ -5,6 +5,7 @@ const lintFiles = '*.{js,cjs,mjs,jsx,ts,cts,mts,tsx}'
 const eslintFiles = '*.{json,jsonc,json5,md,yml,yaml,toml}'
 const formatOnlyFiles = '*.{mdx,css,scss,less,html,vue,svelte,gql,graphql,hbs,handlebars}'
 const checkFix = 'vp check --fix --no-error-on-unmatched-pattern'
+const formatFix = 'vp fmt --no-error-on-unmatched-pattern'
 const eslintFix =
   'eslint --fix --pass-on-unpruned-suppressions --no-error-on-unmatched-pattern --no-warn-ignored'
 
@@ -18,7 +19,8 @@ const nonFrontendIgnores = [
   'dify-agent/**',
   'docker/**',
   'docs/**',
-  'scripts/**',
+  'scripts/**/*',
+  '!scripts/check-web-production-unused-after-knip-fix.mjs',
   'sdks/php-client/**',
   'sdks/python-client/**',
 ]
@@ -46,8 +48,9 @@ export default defineConfig({
   lint: lintConfig,
   staged: {
     [lintFiles]: checkFix,
-    [eslintFiles]: [eslintFix, checkFix],
-    [formatOnlyFiles]: checkFix,
+    [eslintFiles]: [eslintFix, formatFix],
+    [formatOnlyFiles]: formatFix,
+    '.vite-hooks/*': 'sh -n',
   },
   fmt: {
     ignorePatterns: [...nonFrontendIgnores, ...generatedIgnores, ...formatterUnstableInputs],