A gate that checks nothing exits 0, which is indistinguishable from a
clean run — that is why the two invocation bugs fixed in 91f46ff went
unnoticed across 49 commits.
The check runs the configured oxlint command with one rule forced to
warn and requires a non-zero exit. That single probe covers a missing
--deny-warnings, a command that discovers no files, a broken tsconfig
path, and an upstream flag rename. Two things the probe cannot see get
their own assertions: that every gate invokes `pnpm oxlint` with nothing
appended, and that --type-aware is still enabled, since the canary rule
is not type-aware.
Verified against four reconstructed states: the b6ee4c8 and 9b0cb38
configurations, --type-aware removed, and a tsconfig path that matches
no files. Each fails; the current configuration passes.
Follows the existing check-layer-boundaries.mjs pattern — an exported
function driven by a Vitest case.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
LukasandClaude Opus 5
685526d53b