Merge pull request #737 from Nickatak/next-rewrite-deps-bump

Bump dependencies + replace lint stack

Author: RSkuma

.github/workflows/jest-react-test.yml

@@ -0,0 +1,95 @@
+name: Lint
+
+# Backend (ruff + mypy + bandit) and frontend (eslint + stylelint + knip +
+# tsc + prettier) lint suites run as separate parallel jobs. Each fails the
+# build on errors so pull requests cannot merge with a broken lint state.
+#
+# Pre-commit hooks (.pre-commit-config.yaml) run the same tools locally for
+# fast feedback; this workflow is the authoritative gate.
+
+on:
+  push:
+    branches-ignore: [master, main]
+  pull_request:
+    branches: [master, main]
+  workflow_dispatch:
+
+jobs:
+  backend:
+    name: Backend lint (ruff + mypy + bandit)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Poetry
+        run: pipx install poetry
+
+      - name: Install dependencies
+        run: poetry install --no-interaction --no-ansi --no-root
+
+      - name: ruff check
+        run: poetry run ruff check .
+
+      - name: ruff format --check
+        run: poetry run ruff format --check .
+
+      - name: mypy
+        # `backend.settings` reads required env vars via python-decouple at
+        # import time. The django-stubs mypy plugin imports settings to walk
+        # the model graph, so it needs values present even though no real
+        # I/O happens. Dummy values are fine; they're never used.
+        env:
+          SECRET_KEY: lint-only-not-real
+          DJANGO_ALLOWED_HOSTS: localhost
+          SQL_ENGINE: django.db.backends.postgresql
+          SQL_DATABASE: lint
+          SQL_USER: lint
+          SQL_PASSWORD: lint
+          SQL_HOST: localhost
+          SQL_PORT: "5432"
+        run: poetry run mypy ctj_api backend
+
+      - name: bandit
+        run: poetry run bandit -r ctj_api backend -c pyproject.toml -q
+
+  frontend:
+    name: Frontend lint (eslint + stylelint + knip + tsc + prettier)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: prettier --check
+        run: npm run format:check
+
+      - name: eslint
+        run: npm run lint
+
+      - name: stylelint
+        run: npm run lint:css
+
+      - name: tsc --noEmit
+        run: npm run lint:types
+
+      - name: knip
+        run: npm run lint:dead

.github/workflows/lint.yml

@@ -0,0 +1,30 @@
+name: Vitest
+
+on:
+  push:
+    branches-ignore: [master, main]
+  pull_request:
+    branches: [master, main]
+
+jobs:
+  test:
+    name: Vitest
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test

.github/workflows/linter.yml

@@ -1,57 +1,66 @@
+# Pre-commit hooks for fast local feedback. CI is the authoritative gate
+# (see .github/workflows/lint.yml); these hooks run the same tools so issues
+# surface at commit time instead of on PR.
+#
+# Setup (one-time, on the host):
+#   pip install pre-commit
+#   pre-commit install
+#
+# After that, every `git commit` runs the hooks below against staged files.
+# To run all hooks against the entire tree manually: `pre-commit run -a`.
+
 default_language_version:
-  # default language version for each language used in the repository
-  python: python3.9
+  python: python3.13
+  node: "24"
+
 repos:
+  # File-shape hygiene. These are pre-commit's own hooks, applied to every
+  # text file regardless of language.
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
+    rev: v6.0.0
     hooks:
-      # See https://pre-commit.com/hooks.html for more hooks
-      - id: check-ast
-      - id: check-case-conflict
-      - id: check-executables-have-shebangs
       - id: check-merge-conflict
-      - id: debug-statements
+      - id: check-yaml
+        exclude: ^\.github/
+      - id: check-toml
+      - id: check-json
       - id: end-of-file-fixer
-      - id: name-tests-test
-        args: ["--django"]
       - id: trailing-whitespace
-  - repo: https://github.com/pycqa/isort
-    rev: 5.12.0
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  # Backend: ruff replaces black + flake8 + isort. Two separate hooks so the
+  # check (lint) and format passes show as distinct commit-blockers.
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.12
     hooks:
-      - id: isort
-        args: ["--settings-file", "app/setup.cfg"]
-  - repo: https://github.com/psf/black
-    rev: 22.12.0
+      - id: ruff-check
+        args: [--fix]
+        files: ^backend/.*\.py$
+      - id: ruff-format
+        files: ^backend/.*\.py$
+
+  # Frontend: prettier handles formatting (TS/TSX/JS/JSON/CSS).
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.8.3
     hooks:
-      - id: black
-        args: []
-  - repo: https://github.com/PyCQA/flake8
-    rev: 6.0.0
+      - id: prettier
+        files: ^frontend/.*\.(ts|tsx|js|jsx|json|css)$
+
+  # Frontend: eslint and stylelint use local hooks so they pick up the
+  # project's installed versions (not a frozen pre-commit mirror that would
+  # drift from package.json).
+  - repo: local
     hooks:
-      - id: flake8
-        args: ["--config", "app/setup.cfg"]
-        additional_dependencies:
-          [
-            "flake8-bugbear",
-            "flake8-comprehensions",
-            "flake8-mutable",
-            "flake8-print",
-            "flake8-simplify",
-          ]
-  - repo: https://github.com/pycqa/pylint
-    rev: "v2.15.10"
-    hooks:
-      - id: pylint
-        exclude: "[a-zA-Z]*/(migrations)/(.)*|(mkdocs)/(.)*"
-        args:
-          [
-            "--load-plugins=pylint_django",
-            "--disable=C0114,C0115,C0116",
-            "--django-settings-module=config.settings",
-            "--rcfile=app/setup.cfg",
-          ]
-        additional_dependencies: [django, djangorestframework, pylint_django]
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: "v2.7.1"
-    hooks:
-      - id: prettier
+      - id: eslint
+        name: eslint
+        language: node
+        entry: bash -c 'cd frontend && npx eslint .'
+        files: ^frontend/.*\.(ts|tsx|js|jsx|mjs)$
+        pass_filenames: false
+      - id: stylelint
+        name: stylelint
+        language: node
+        entry: bash -c 'cd frontend && npx stylelint "src/**/*.{css,module.css}"'
+        files: ^frontend/src/.*\.(css|module\.css)$
+        pass_filenames: false

.github/workflows/vitest-test.yml

@@ -29,6 +29,17 @@ Filing the issue first (before writing code) lets feedback shape scope before im
 
 Frontend styling uses **CSS Modules**: co-locate a `Component.module.css` next to each component's `.tsx` file. No Tailwind, no styled-components, no CSS-in-JS runtime. See the [design system guide](docs/developer/design-system.md) for the full conventions.
 
+### Type annotations (backend)
+
+The Python codebase has `mypy` running in **gradual mode** — `disallow_untyped_defs` is `false`, so missing annotations don't fail CI. The intent is to ratchet stricter over time, not to demand annotations on every change. Concretely:
+
+- **New code**: add type annotations to function signatures (parameters and return types). Inside function bodies, only annotate where the type is non-obvious or the inference is wrong.
+- **Existing code you touch**: if you're already editing a function for another reason, adding annotations is welcome but not required.
+- **Don't annotate just to silence mypy.** If a type is genuinely ambiguous (`Any` is fine, `# type: ignore[code]` with the specific code is fine when you know why), say so explicitly rather than papering over it.
+- **Django models**: `django-stubs` and `djangorestframework-stubs` are installed; mypy can check ORM call sites without per-call annotation.
+
+The goal is that contributors can land work without fighting the type checker, while the typed surface grows incrementally where it pays for itself.
+
 If an issue takes much longer than its size suggested, post an update on the issue with an honest read on whether you can finish; releasing it back to the backlog is fine.
 
 ### Frontend vs backend issues

.pre-commit-config.yaml

@@ -49,7 +49,7 @@ Developer docs live in [docs/developer/](docs/developer/):
 - [DevOps Architecture](docs/developer/devops.md)
 - [Deployment & Infrastructure](docs/developer/deployment-infra.md)
 - [Design System](docs/developer/design-system.md)
-- [ESLint Guide](docs/developer/eslint-guide.md)
+- [Frontend Lint Guide](docs/developer/frontend-lint-guide.md)
 - [Git Branch Structure](docs/developer/git-branch-structure.md)
 - [Installation](docs/developer/installation.md)
 - [Quickstart Guide](docs/developer/quickstart-guide.md)

CONTRIBUTING.md

@@ -115,7 +115,9 @@
 
 AUTH_PASSWORD_VALIDATORS = [
     {
-        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+        "NAME": (
+            "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"
+        ),
     },
     {
         "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",