ci: enforce catalog for dependencies shared by 2+ packages

[simshanith]

What

Adds a hard CI gate that fails when a dependency is declared with an inline registry range (e.g. ^1.2.3) in two or more workspace packages. Such deps must instead live in the catalog: in pnpm-workspace.yaml and be referenced as catalog:.

catalogMode: prefer only softly nudges new pnpm adds toward the catalog; this check is the hard backstop that keeps duplication from drifting back in via hand-edited package.json or a --save-catalog-less add.

How

• scripts/check-catalog.core.mjs — pure logic, zero IO, so each unit is testable with plain fixtures: isInlineRegistryRange, collectInlineUsage, findViolations, catalogDepNames, formatReport (catalog-aware hint: "add X" vs "catalog already defines X").
• scripts/check-catalog.mjs — thin IO shell. Uses pnpm's own SDK (@pnpm/fs.find-packages + @pnpm/workspace.read-manifest) to enumerate workspace members and read the catalogs.
  • Not the lockfile — it has already resolved catalog: → concrete versions, erasing the inline-vs-catalogued distinction.
  • Not hand-parsed YAML — a YAML lib would still leave glob expansion hand-rolled; the SDK is pnpm's resolver, so examples/* tutorials are correctly excluded as non-members.
• scripts/check-catalog.test.mjs — 13 node:test unit tests (zero new test deps).

Wiring

• //#check:catalog → ci.dependsOn.
• //#test:root (node --test "scripts/**/*.test.mjs") attached to the test task via with, mirroring lint:root/format:root — so turbo run test and turbo run ci both run it, and any future scripts/**/*.test.mjs is auto-discovered.
• eslint.config.js: extended the node-globals block to **/*.mjs.

The single turbo run ci --ui=stream in CI covers both new tasks — no workflow edit.

Notes

• Current repo passes (no dep is inline in 2+ members today).
• catalogMode: prefer auto-routed the two new @pnpm/* dev deps into the catalog (single-consumer, harmless).

Test plan

• pnpm check:catalog passes (8 members)
• pnpm test:root — 13/13
• Injecting a duplicate (lodash into two packages) fails with a drift-aware message
• turbo run check:catalog test:root lint green; prettier + eslint clean

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	lit-ui-router	2028305	Commit Preview URL Branch Preview URL	Jun 03 2026, 07:12 AM

[github-actions]

Coverage Report for packages/lit-ui-router

Status	Category	Percentage	Covered / Total
🔵	Lines	97.44%	382 / 392
🔵	Statements	97.05%	395 / 407
🔵	Functions	96.9%	94 / 97
🔵	Branches	88.23%	150 / 170

File Coverage

No changed files found.

Generated in workflow #313 for commit 2028305 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for packages/navigation-location-plugin

Status	Category	Percentage	Covered / Total
🔵	Lines	95.83%	23 / 24
🔵	Statements	95.83%	23 / 24
🔵	Functions	100%	6 / 6
🔵	Branches	85%	17 / 20

File Coverage

No changed files found.

Generated in workflow #313 for commit 2028305 by the Vitest Coverage Report Action

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.27%. Comparing base (da8494d) to head (2028305).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #145   +/-   ##
=======================================
  Coverage   97.27%   97.27%           
=======================================
  Files           6        6           
  Lines         514      514           
  Branches      102      102           
=======================================
  Hits          500      500           
  Misses         14       14           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.