fix: repair pnpm run lint and gate it in CI

[JohnMcLear]

Why

pnpm run lint was broken in this repo and nothing noticed, because no workflow
ran it.

typescript was pinned to ^7.0.2. TypeScript 7 is the native port and no
longer exposes the legacy compiler API, so ts-api-utils throws
Cannot read properties of undefined (reading 'Intrinsic') while the ESLint
config is still loading, and takes the whole config down before a single file is
linted.

What changed

• typescript ^7.0.2 → ~6.0.3. eslint-config-etherpad@5 declares
  typescript: ">=4.8.4 <6.1.0", so a future TypeScript major now fails loudly
  at install time instead of silently breaking lint.
• eslint-config-etherpad ^4.0.5 → ^5.0.0.
• New .github/workflows/lint.yml, wired into test-and-release.yml as a
  lint job and added to the release job's needs: — so lint now gates
  releases the same way the backend/frontend tests do.
• Lockfile regenerated. The diff is large because TypeScript 7 ships ~20
  per-platform binaries that TypeScript 6 does not.

Lint result

pnpm run lint is clean with no code changes at all — the config was the only
thing broken.

Follows the already-merged ether/ep_cursortrace#117,
ether/ep_clear_formatting#96 and ether/ep_git_commit_saved_revision#107.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Repair lint toolchain and gate releases on ESLint

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Align TypeScript and Etherpad ESLint configuration versions to restore linting.
• Add a reusable ESLint workflow using the repository’s supported Node and pnpm setup.
• Require successful lint, backend, and frontend checks before releasing.

Diagram

graph TD
  Push["Repository push"] --> CI["Test and release"] --> Lint["Lint workflow"] --> Install["Compatible toolchain"] --> ESLint["ESLint check"]
  CI --> Tests["Backend and frontend"] --> Release["Package release"]
  ESLint --> Release

Loading

High-Level Assessment

The selected approach is appropriate: constrain TypeScript to the ESLint configuration’s declared compatibility range, upgrade the shared configuration, and model lint as a reusable workflow consistent with existing test jobs. Pinning only the older TypeScript version would preserve an outdated lint stack, while embedding lint directly in the release workflow would reduce reuse and consistency.

Files changed (4) +304 / -474

Bug fix (1) +2 / -2

package.jsonAlign the TypeScript and ESLint configuration versions +2/-2

Align the TypeScript and ESLint configuration versions

• Upgrades 'eslint-config-etherpad' to version 5 and constrains TypeScript to the compatible 6.0 patch line, restoring ESLint configuration loading and preventing incompatible future major upgrades.

package.json

Other (3) +302 / -472

lint.ymlAdd reusable ESLint workflow +35/-0

Add reusable ESLint workflow

• Introduces a reusable GitHub Actions workflow that configures Node 25 and pnpm 10, restores the pnpm cache, installs dependencies without scripts, and runs 'pnpm run lint'.

.github/workflows/lint.yml

test-and-release.ymlGate releases on successful linting +4/-0

Gate releases on successful linting

• Invokes the new lint workflow alongside backend and frontend validation. Adds lint to the release job dependencies so publication cannot proceed after a lint failure.

.github/workflows/test-and-release.yml

pnpm-lock.yamlRegenerate the lint dependency graph +263/-472

Regenerate the lint dependency graph

• Locks TypeScript 6.0.3 and 'eslint-config-etherpad' 5.0.2 with their updated TypeScript ESLint and plugin dependencies. Removes the TypeScript 7 platform-specific packages and obsolete transitive dependencies.

pnpm-lock.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Fork pull requests skip lint checks 🐞 Bug ≡ Correctness

Description

lint.yml exposes only workflow_call, while its sole caller test-and-release.yml listens only
for push and workflow_dispatch. A pull request from an external fork does not create a push in
this repository, so it can merge without the new check and any lint failure is discovered only
during the post-merge release run.

Code

.github/workflows/lint.yml[R3-4]

+on:
+  workflow_call:

Evidence

The new workflow declares only workflow_call, and the only added caller belongs to a workflow
triggered exclusively by pushes or manual dispatches. The backend reusable workflow explicitly
contains handling for external-fork pull requests, further showing that pull-request events are
expected but currently never supplied by the parent workflow.

.github/workflows/lint.yml[3-4]
.github/workflows/test-and-release.yml[1-9]
.github/workflows/backend-tests.yml[3-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The lint workflow is callable only from `test-and-release.yml`, whose triggers exclude pull requests. Consequently, external-fork pull requests receive no lint check before merge.
## Fix Focus Areas
- .github/workflows/lint.yml[3-4]
- .github/workflows/test-and-release.yml[1-9]
- .github/workflows/backend-tests.yml[3-14]
## Recommended Fix
Add a `pull_request` trigger to `test-and-release.yml` so reusable lint and test jobs run for external-fork pull requests. Preserve the release job's existing default-branch condition and, if necessary, use job conditions to avoid duplicate checks for same-repository branches already covered by `push`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗