Release v0.2.2 - self-host JS lint + typecheck (#2)

* ci: self-host JS lint + typecheck

The CI comment used to delegate ESLint + tsc to the consuming blog
repo, which made sense when the blog vendored the theme as a submodule
and could reach into assets/js/. Once consumers switch to Hugo Modules
the theme's JS source no longer lives in their working tree, so the
tooling has to live where the code lives.

Brings eslint.config.mjs, a minimal package.json (eslint + typescript
devDeps, lint/typecheck scripts), and a lint job that mirrors the blog
workflow (setup-node, npm ci --ignore-scripts, eslint, tsc).

* docs: add CHANGELOG entry for self-hosted JS lint

* docs: stage v0.2.2 and strip guidance prose from [Unreleased]

Introduces ## [0.2.2] under [Unreleased] with the self-hosted lint
entry, so tagging v0.2.2 after merge publishes cleanly from the
extracted section without a follow-up rename commit.

Drops the contributor-facing instructional paragraph that was living
inside [Unreleased]. Keep a Changelog doesn't put prose there; past
released sections already demonstrate the ### Added / ### Changed
shape, and changelog.yml emits its own failure message when a PR
omits a required entry, so the guidance is over-documented for a
repo this size.

---------

Co-authored-by: Przemysław Szypowicz <2733699+pszypowicz@users.noreply.github.com>

Author: pszypowicz

.github/workflows/ci.yml

@@ -9,11 +9,10 @@ on:
 permissions:
   contents: read
 
-# The theme is consumed by the blog repo, which runs the full budget /
-# lint / typecheck matrix. This workflow is a lightweight sanity gate:
-# it confirms the theme still compiles against a representative site
-# (exampleSite/) so broken SCSS imports or template syntax errors are
-# caught before a blog-side submodule bump exposes them.
+# The theme owns its own lint + typecheck for the JS assets under
+# assets/js/, and builds exampleSite/ as a sanity gate so broken SCSS
+# imports or template syntax errors surface before downstream consumers
+# bump to a new version.
 
 jobs:
   build:
@@ -38,3 +37,20 @@ jobs:
       - name: Build exampleSite
         working-directory: pager/exampleSite
         run: hugo --minify --gc --themesDir ../.. --destination public
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
+        with:
+          node-version: '22'
+          cache: npm
+      - name: Install npm devDependencies
+        # --ignore-scripts blocks postinstall hooks so a malicious
+        # package-lock.json change cannot execute code during install.
+        run: npm ci --include=dev --ignore-scripts
+      - name: ESLint
+        run: npm run lint
+      - name: TypeScript check
+        run: npm run typecheck

CHANGELOG.md

@@ -7,13 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-Add bullets here under `### Added`, `### Changed`, `### Fixed`, or `### Removed`
-when a PR modifies theme behavior. On release, rename this heading to the new
-version (dates are not tracked here; the git tag carries them), then push an
-annotated tag `vX.Y.Z`; `.github/workflows/release.yml` turns the extracted
-section into a GitHub Release body. Docs-only, CI-only, or meta-only PRs can
-bypass the PR-side check via the `skip-changelog` label or a `[skip changelog]`
-tag in the PR body; see `.github/workflows/changelog.yml`.
+## [0.2.2]
+
+### Added
+
+- Self-hosted ESLint and `tsc --checkJs` for `assets/js/`. The theme
+  ships `package.json` (eslint + typescript devDeps, `lint` /
+  `typecheck` scripts) and `eslint.config.mjs`, and `ci.yml` gains a
+  `lint` job. Consumers on Hugo Modules (where the theme's JS source
+  is not in the consumer tree) no longer need to re-host this tooling.
 
 ## [0.2.1]
 

eslint.config.mjs

@@ -0,0 +1,43 @@
+import js from "@eslint/js";
+
+export default [
+  {
+    files: ["assets/js/**/*.js"],
+    languageOptions: {
+      ecmaVersion: 2020,
+      sourceType: "module",
+      globals: {
+        // Browser globals used by debug scripts. Kept explicit instead
+        // of pulling in eslint's `browser` env so additions to this list
+        // stay visible in review.
+        window: "readonly",
+        document: "readonly",
+        navigator: "readonly",
+        location: "readonly",
+        innerWidth: "readonly",
+        innerHeight: "readonly",
+        devicePixelRatio: "readonly",
+        performance: "readonly",
+        getComputedStyle: "readonly",
+        console: "readonly",
+        localStorage: "readonly",
+        fetch: "readonly",
+        setTimeout: "readonly",
+        setInterval: "readonly",
+        clearInterval: "readonly",
+        addEventListener: "readonly",
+        HTMLElement: "readonly",
+        PerformanceNavigationTiming: "readonly",
+        DOMParser: "readonly",
+      },
+    },
+    rules: {
+      ...js.configs.recommended.rules,
+      "no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
+      "no-implicit-globals": "error",
+      "no-var": "error",
+      "prefer-const": "warn",
+      eqeqeq: ["error", "smart"],
+    },
+  },
+];