build(lint): add ESLint flat configs for both workspaces (kaito-project#320)

Signed-off-by: Suraj Deshmukh <suraj.deshmukh@microsoft.com>
Co-authored-by: Claude Opus 4 <noreply@anthropic.com>

Author: surajssd

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
         run: bun ci
 
       - name: Verify generated versions are up to date
-        run: bun run verify-versions
+        run: make verify-versions
 
       - name: Build frontend
         run: bun run build:frontend

.github/workflows/test.yml

@@ -29,23 +29,54 @@ jobs:
         run: make compile
 
       - name: Run backend tests with coverage
+        shell: bash
         run: |
-          cd backend
-          echo "## 🧪 Backend Test Coverage" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          bun test --coverage 2>&1 | tail -20 >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
+          set -o pipefail
+          rc=0
+          make test-coverage-backend 2>&1 | tee /tmp/backend-cov.log || rc=$?
+          {
+            echo "## 🧪 Backend Test Coverage"
+            echo ""
+            echo '```'
+            tail -20 /tmp/backend-cov.log
+            echo '```'
+            echo ""
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit $rc
 
       - name: Run frontend tests with coverage
+        shell: bash
         run: |
-          cd frontend
-          echo "## 🎨 Frontend Test Coverage" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          bun run test:coverage 2>&1 | tail -30 >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          set -o pipefail
+          rc=0
+          make test-coverage-frontend 2>&1 | tee /tmp/frontend-cov.log || rc=$?
+          {
+            echo "## 🎨 Frontend Test Coverage"
+            echo ""
+            echo '```'
+            tail -30 /tmp/frontend-cov.log
+            echo '```'
+            echo ""
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit $rc
+
+  web-ui-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun ci
+
+      - name: Lint (frontend + backend)
+        run: make lint
 
   controller-manifest-check:
     runs-on: ubuntu-latest

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install dev dev-frontend dev-backend build compile lint test clean help providers-test verify-versions test-verify-versions
+.PHONY: install dev dev-frontend dev-backend build compile lint test test-coverage test-coverage-backend test-coverage-frontend clean help providers-test verify-versions test-verify-versions
 .PHONY: controller-build controller-docker-build controller-install controller-deploy controller-generate generate-deploy-manifests
 .PHONY: model-downloader-docker-build setup-gateway cleanup-gateway
 
@@ -41,6 +41,7 @@ help:
 	@echo "  compile-windows        Cross-compile for Windows (x64)"
 	@echo "  lint                   Run linters"
 	@echo "  test                   Run tests"
+	@echo "  test-coverage          Run tests with coverage (frontend + backend)"
 	@echo "  clean                  Remove build artifacts and node_modules"
 	@echo ""
 	@echo "Controller Targets:"
@@ -125,6 +126,18 @@ lint:
 test: verify-versions
 	bun run test
 
+# Testing with coverage (CI entrypoint). Coverage prints to stdout;
+# GitHub step-summary formatting lives in the workflow, not here.
+# Uses `cd <ws> && bun run test:coverage` (not `bun run --filter`) so output
+# stays unprefixed and the coverage tables render cleanly in the CI summary.
+test-coverage: verify-versions test-coverage-backend test-coverage-frontend
+
+test-coverage-backend:
+	cd backend && bun run test:coverage
+
+test-coverage-frontend:
+	cd frontend && bun run test:coverage
+
 # Clean build artifacts
 clean:
 	rm -rf node_modules frontend/node_modules backend/node_modules shared/node_modules

backend/eslint.config.mjs

@@ -1,36 +1,33 @@
-// Flat ESLint config (ESLint v9+). Replaces the old .eslintrc + `--ext` flow,
-// which ESLint v9 removed. TypeScript is linted via the typescript-eslint
-// plugin's `flat/recommended` preset, which bundles the parser, the plugin, and
-// a non-type-checked rule set (fast, low false-positive noise).
-import tseslint from '@typescript-eslint/eslint-plugin';
-import tsparser from '@typescript-eslint/parser';
+// ESLint flat config for the backend (Bun + Hono + TypeScript).
+//
+// ESLint 9+ no longer reads `.eslintrc.*`; this flat config is the replacement.
+// The package is CommonJS (no `"type": "module"`), so this file uses the `.mjs`
+// extension to be loaded as ESM.
+import tseslint from '@typescript-eslint/eslint-plugin'
 
 export default [
-  // Only application source is linted (mirrors the previous `eslint src` scope).
-  {
-    ignores: ['dist/**', 'node_modules/**', '*.config.*', 'coverage/**'],
-  },
+  // Build artifacts, compiled binaries, and generated output are never linted.
+  { ignores: ['dist/**', 'build/**', 'coverage/**'] },
 
-  // typescript-eslint's flat/recommended turns off core rules that clash with
-  // TS (e.g. no-undef), wires up the parser, and enables the recommended rules.
+  // typescript-eslint's recommended flat config wires up the TS parser, the
+  // `@typescript-eslint` plugin, and a sensible rule set. It also turns off
+  // core rules (e.g. `no-undef`) that TypeScript already enforces, so we don't
+  // need the `globals` package for Node/Bun globals like `process` or `Bun`.
   ...tseslint.configs['flat/recommended'],
 
   {
-    files: ['src/**/*.ts'],
-    languageOptions: {
-      parser: tsparser,
-      ecmaVersion: 'latest',
-      sourceType: 'module',
-    },
+    files: ['**/*.ts'],
     rules: {
-      // Pre-existing debt: this codebase predates any ESLint config (the v8→v10
-      // bump first introduced one), so `recommended` surfaces ~120 historical
-      // violations of these two rules — none in newly-written code. Demote them
-      // to warnings so lint is green and CI-usable today, while still surfacing
-      // the backlog for incremental burndown. Promote back to "error" once the
-      // existing hits are cleared.
-      '@typescript-eslint/no-explicit-any': 'warn',
-      '@typescript-eslint/no-unused-vars': 'warn',
+      // Allow intentionally-unused identifiers when prefixed with `_`
+      // (e.g. unused function params kept for signature/positional reasons).
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+        },
+      ],
     },
   },
-];
+]

backend/src/hono-app.test.ts

@@ -1,8 +1,9 @@
-import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { describe, test, expect, afterEach } from 'bun:test';
 import app, { parseCorsOrigin } from './hono-app';
 import { kubernetesService } from './services/kubernetes';
 import { configService } from './services/config';
 import { authService } from './services/auth';
+import { helmService } from './services/helm';
 import { mockServiceMethod } from './test/helpers';
 import { mockDeployment } from './test/fixtures';
 import { HTTPException } from 'hono/http-exception';
@@ -1288,10 +1289,21 @@ describe('Hono Routes', () => {
 
   describe('Installation Routes', () => {
     test('GET /api/installation/helm/status returns helm status', async () => {
-      const res = await app.request('/api/installation/helm/status');
-      expect(res.status).toBe(200);
-      const data = await res.json();
-      expect(data.available).toBeDefined();
+      // Mock the helm CLI probe so the test never spawns the real `helm`
+      // binary, which hangs on CI runners where helm is absent. Mirrors the
+      // pattern used throughout installation.test.ts.
+      const restore = mockServiceMethod(helmService, 'checkHelmAvailable', async () => ({
+        available: true,
+        version: 'v3.14.0',
+      }));
+      try {
+        const res = await app.request('/api/installation/helm/status');
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        expect(data.available).toBeDefined();
+      } finally {
+        restore();
+      }
     });
   });
 

backend/src/lib/kubeconfig.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach, afterEach } from 'bun:test';
 import * as k8s from '@kubernetes/client-node';
-import { kubeConfigToBunTls, BunTlsHttpLibrary, makeApiClient } from './kubeconfig';
+import type * as https from 'node:https';
+import { kubeConfigToBunTls, BunTlsHttpLibrary, makeApiClient, type BunTlsOptions } from './kubeconfig';
 
 /**
  * Regression guards for the Bun TLS shim (`kubeConfigToBunTls`,
@@ -47,8 +48,8 @@ function makeKubeConfig(opts: KcOpts = {}): k8s.KubeConfig {
   }
 
   kc.loadFromOptions({
-    clusters: [cluster as any],
-    users: [user as any],
+    clusters: [cluster as unknown as k8s.Cluster],
+    users: [user as unknown as k8s.User],
     contexts: [{ name: 'test-ctx', cluster: 'test-cluster', user: 'test-user' }],
     currentContext: 'test-ctx',
   });
@@ -102,7 +103,7 @@ describe('kubeConfigToBunTls', () => {
 
 describe('BunTlsHttpLibrary.send', () => {
   const realFetch = globalThis.fetch;
-  let calls: Array<{ url: string; options: any }>;
+  let calls: Array<{ url: string; options: RequestInit & { tls?: BunTlsOptions } }>;
 
   beforeEach(() => {
     calls = [];
@@ -112,7 +113,7 @@ describe('BunTlsHttpLibrary.send', () => {
   });
 
   function stubFetch(status = 200, body = '{"ok":true}') {
-    globalThis.fetch = (async (url: any, options: any) => {
+    globalThis.fetch = (async (url: RequestInfo | URL, options: RequestInit & { tls?: BunTlsOptions }) => {
       calls.push({ url: String(url), options });
       return new Response(body, { status, headers: { 'content-type': 'application/json' } });
     }) as typeof fetch;
@@ -168,7 +169,7 @@ describe('BunTlsHttpLibrary.send', () => {
     const kc = makeKubeConfig({ withClientCert: true });
     let applyCount = 0;
     const orig = kc.applyToHTTPSOptions.bind(kc);
-    kc.applyToHTTPSOptions = (async (opts: any) => {
+    kc.applyToHTTPSOptions = (async (opts: https.RequestOptions) => {
       applyCount += 1;
       return orig(opts);
     }) as typeof kc.applyToHTTPSOptions;

backend/src/lib/kubeconfig.ts

@@ -1,4 +1,5 @@
 import * as k8s from '@kubernetes/client-node';
+import type * as https from 'node:https';
 import logger from './logger';
 
 /**
@@ -23,10 +24,19 @@ export function loadKubeConfig(): k8s.KubeConfig {
   if (process.env.AUTH_ENABLED?.toLowerCase() === 'true' || process.env.AUTH_ENABLED === '1') {
     const currentUser = kc.getCurrentUser();
     if (currentUser) {
-      (currentUser as any).certData = undefined;
-      (currentUser as any).certFile = undefined;
-      (currentUser as any).keyData = undefined;
-      (currentUser as any).keyFile = undefined;
+      // The k8s User fields are declared `readonly`, but we must clear the
+      // client certificates before any API client is created. Cast to a
+      // writable view of just those fields instead of using `any`.
+      const writableUser = currentUser as {
+        certData?: string;
+        certFile?: string;
+        keyData?: string;
+        keyFile?: string;
+      };
+      writableUser.certData = undefined;
+      writableUser.certFile = undefined;
+      writableUser.keyData = undefined;
+      writableUser.keyFile = undefined;
       logger.debug('Stripped client certificates from kubeconfig (AUTH_ENABLED)');
     }
   }
@@ -92,7 +102,7 @@ export async function kubeConfigToBunTls(kc: k8s.KubeConfig): Promise<BunTlsOpti
     servername?: string;
     rejectUnauthorized?: boolean;
   } = {};
-  await kc.applyToHTTPSOptions(httpsOptions as any);
+  await kc.applyToHTTPSOptions(httpsOptions as https.RequestOptions);
 
   const tls: BunTlsOptions = {};
   if (httpsOptions.ca) tls.ca = httpsOptions.ca;

backend/src/lib/logger.ts

@@ -1,14 +1,5 @@
 import pino from 'pino';
 
-// Check if running in compiled binary mode
-const isCompiled = (): boolean => {
-  try {
-    return import.meta.dir?.includes('/$bunfs/') || process.env.BUN_SELF_EXECUTABLE !== undefined;
-  } catch {
-    return false;
-  }
-};
-
 // Use simple JSON logging in production/compiled mode
 // pino-pretty transport doesn't work in compiled binaries
 export const logger = pino({

backend/src/routes/autoscaler.ts

@@ -1,8 +1,5 @@
 import { Hono } from 'hono';
 import { autoscalerService } from '../services/autoscaler';
-import { kubernetesService } from '../services/kubernetes';
-import { zValidator } from '@hono/zod-validator';
-import { z } from 'zod';
 import logger from '../lib/logger';
 
 const autoscaler = new Hono()

backend/src/routes/costs.ts

@@ -131,7 +131,6 @@ export const costsRoutes = new Hono()
           );
 
           if (result.success && result.price) {
-            const totalGpus = gpuCount * replicas;
             const hourlyPrice = result.price.hourlyPrice * replicas; // Full VM cost per replica
             const monthlyPrice = hourlyPrice * 730;