Code Quality

One Rust toolchain formats and lints the whole monorepo, and Lefthook runs it (plus a build and a commit-message check) at the moments a mistake would otherwise slip through. You rarely invoke any of it by hand.

Oxc, not ESLint + Prettier

Oxc replaces both ESLint and Prettier with two commands: oxlint for linting and oxfmt for formatting. They're written in Rust, so they finish in a fraction of the time, fast enough to run on every commit without you noticing. That speed is the whole reason to switch.

The config is deliberately small. .oxlintrc.jsonc is three lines, just a schema, every rule at its default:

{
  "$schema": "./node_modules/oxlint/configuration_schema.json",
}

.oxfmtrc.jsonc turns off semicolons, sorts imports, sorts Tailwind classes, and skips the AI skill directory:

{
  "$schema": "./node_modules/oxfmt/configuration_schema.json",
  "semi": false,
  "experimentalSortImports": {},
  "experimentalTailwindcss": {},
  "ignorePatterns": [".agents/**"],
}

Run either across the tree yourself:

bun run lint          # oxlint over everything (this is what CI runs)
bun run format        # oxfmt, writing fixes
bun run format:check  # oxfmt, report only (also what CI runs)

The git hooks

lefthook.yml wires three hooks:

pre-commit:
  piped: true
  commands:
    lint-staged:
      run: bunx lint-staged --verbose
      stage_fixed: true
    build:
      run: bun run build
      use_stdin: true

commit-msg:
  commands:
    commitlint:
      run: bunx commitlint --edit {1}

pre-push:
  commands:
    audit:
      run: bun audit --audit-level high
      only:
        - ref: canary
    ensure-branches:
      run: bun .github/scripts/ensure-remote-branches.ts {1}

pre-commit: lint-staged formats then lints only your staged files (oxfmt, then oxlint); stage_fixed: true re-stages anything the formatter rewrote, so the fix rides along in the same commit. Then a full bun run build has to pass. A commit that lands is formatted, linted, and building.

commit-msg: Commitlint checks the message against Conventional Commits (below).

pre-push: bun audit --audit-level high runs, but only from canary (only: ref: canary), so a vulnerable dependency is caught before the branch leaves your machine without blocking your offline commits. ensure-remote-branches.ts seeds the release branches (default main) that drive the release PR (see Releases).

On a pull request, the auto-check-build workflow re-runs the full gate on GitHub: bun audit, bun run format:check, bun run lint, bun run check-types, bun run test, and bun run build. A failing type error or test blocks the merge, so the checks that are cheap to skip locally (the pre-commit build tolerates type errors that tsc would reject) still cannot reach canary.

Commit messages

Messages follow Conventional Commits: <type>(<scope>): <subject>. Common types are feat, fix, docs, refactor, chore, test, perf, and style; build and revert are also accepted.

feat(auth): add Google OAuth provider
fix(api): handle null user in session middleware
docs(readme): update setup steps

Two repo rules the hook and skills enforce:

• Never add a Co-authored-by trailer.
• ci is reserved for pipeline-generated commits (the changelog bot) and is filtered out of the changelog; use fix(ci) or docs(ci) for real CI work.

Common fixes

• A commit failed on formatting or lint: run bun run format (and bun run lint), git add the result, and commit again.
• Commitlint rejected the message: rewrite it as type: subject; add user page becomes feat: add user page.
• Hooks aren't running: reinstall them with bun run prepare.
• You need to bypass in an emergency: git commit --no-verify, or LEFTHOOK=0 git commit … to drop every hook, or LEFTHOOK_EXCLUDE=build git commit … to drop just the build. CI re-checks all of it anyway.

Dependency advisories that can only be resolved with a package.json override are recorded in .github/notes/dependencies.md; the audit skill walks you through it.

Next

• Releases: how those conventional commits become a changelog and a tagged release.
• Scripts: lint, format, build, and the rest, in one place.