tooling: add JavaScript and Lua maintainability checks

[Kzoeps]

Summary

• Add ESLint subprocess and process-exit safeguards, with explicit coverage limitations.
• Enable noUncheckedIndexedAccess and expand strict checkJs to installer, HTTP test runner, seed tooling, and imported fixtures.
• Add manifest-bounded Lua parameter-contract checks, conservative helper-dependency diagnostics, authored-source Luacheck locations, and advisory direct SQL interpolation checks.
• Add regression coverage and maintenance documentation; preserve endpoint behavior and generated bundles.

Validation

• Two implementation workers and two independent reviewers; review corrections rechecked.
• pnpm check passed: 326 API tests and 17 documentation tests, plus lint, typechecking, and generated-bundle freshness.
• git diff --check passed.
• HTTP/Docker runtime tests were not run.

Limitations

• Lua parameter contracts: 47 verified, 8 dynamic cases explicitly unverified.
• One helper-availability case remains unverified and nonblocking.
• SQL detection is advisory, not general taint analysis.
• Static JS restrictions do not track arbitrary aliases or computed expressions.

Unrelated feed Lexicon drafts are excluded.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 76da41d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
api-endpoints	Skipped		Oct 7, 2026 8:16am UTC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 35 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 65827284-ca33-4088-8868-4bc19124305c

📥 Commits

Reviewing files that changed from the base of the PR and between fd96994 and 76da41d.

📒 Files selected for processing (17)

• api/eslint.config.js
• api/tests/fixtures/activities.js
• api/tests/fixtures/actor-follows.js
• api/tests/fixtures/bad-dates.js
• api/tests/fixtures/bad-location-dates.js
• api/tests/fixtures/records.js
• api/tests/unit/tooling/eslint-maintainability.test.js
• api/tests/unit/tooling/lint-lua.test.js
• api/tests/unit/tooling/lua-maintainability.test.js
• api/tooling/installer.js
• api/tooling/js-maintainability.md
• api/tooling/lint-lua.js
• api/tooling/lua-maintainability.js
• api/tooling/lua-maintainability.md
• api/tooling/run-http-tests.js
• api/tooling/seed.js
• api/tsconfig.json

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Kzoeps]

(reply generated by OpenAI Codex)

Addressed the 24 annotations from Sonar check 112689351993 in 045ef78. Simplified annotated functions and expressions, added explicit deterministic sorting, and parallelized independent reads while preserving diagnostic/error order. The localeCompare suggestion was adapted to a UTF-16 comparator to preserve behavior.

Independent review found no confirmed regression. pnpm check passed: 330 API tests and 17 documentation tests, plus lint, typechecking, and bundle freshness. Scanner-side resolution remains unverified pending the new analysis; the cancelled analysis returned no linked issue records via the Sonar API.

Regarding the Changeset notice: this PR changes development validation/tooling, not installed endpoint behavior or operator configuration, so no version bump is intended.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud