OpenConceptLab/ocl_issues#2838 | Pull requests run the Eslint job, and npm run eslint lints .jsx

[paynejd]

Part of OpenConceptLab/ocl_issues#2838 (oclweb2). The same change as OpenConceptLab/oclmap#84 and OpenConceptLab/oclweb3#57.

Summary

Lint ran only in build.yml, which runs on manual dispatch, so a pull request showed no lint result before it merged.

Change

• .github/workflows/pr.yml (new): runs build.yml's "Eslint" job steps, unchanged, on every pull_request:

  • the start-prod.sh secret check
  • Node 14 with the npm cache, and npm ci
  • ./node_modules/eslint/bin/eslint.js --ext .jsx,.js src/

  It has a read-only token, and a newer push to the same PR cancels the older run. build.yml is untouched.

• package.json: the eslint script adds --ext .jsx,.js. Without it ESLint lints only .js files, so npm run eslint skipped every .jsx file.

Test plan

• The workflow's steps are identical to build.yml's "Eslint" job (diffed).
• CI's commands, run locally in Docker node:14 (amd64, because node-sass 4 doesn't build on current Node):
  • npm ci passes.
  • ./node_modules/eslint/bin/eslint.js --ext .jsx,.js src/ is clean.
  • npm run eslint now reports an unused import in a throwaway .jsx file.
• The new "PR checks / Eslint" check ran on this PR and passed, every step.
• Codex adversarial review, posted on this PR: clean. A read-only Claude review, posted earlier as a stand-in while Codex was at its usage limit, was also clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Lkm1wDY1zKSDTm2apzPJLi

[paynejd]

Claude review subagent: stand-in until the Codex pass runs (commit 53f7793)

Codex was at its usage limit, so a read-only Claude Code review subagent reviewed this PR first. The Codex adversarial review will be posted separately, and the PR waits for it before merging.

Outcome: No issues found.

---

Verdict: I found no real issues.

What I checked:

• Steps match build.yml. I ran diff on build.yml:21-41 against pr.yml:18-38 and they are byte-for-byte identical: checkout, the start-prod.sh secret-shape guard, setup-node 14 with npm cache, npm ci, and eslint.js --ext .jsx,.js src/. The job id and name (eslint / "Eslint") also match. build.yml is not in the diff.
• Fork and branch safety. The trigger is plain pull_request, not pull_request_target. permissions: contents: read is set at the top level, and nothing references secrets.* or environment:. Nothing pushes, builds an image or deploys. A fork PR gets a read-only token and no secrets.
• Concurrency. pr-checks-${{ github.event.pull_request.number }} is always set on pull_request events and is scoped to one PR, so a new push cancels the older run. It can't collide with build.yml's release-${{ github.ref }} group.
• Double-run. None. build.yml only runs on workflow_dispatch.
• Script change. Nothing in the repo (excluding node_modules) calls npm run eslint: no Dockerfile step, husky or lint-staged hook, or doc. The Dockerfile only runs npm run build. README.md:18 calls eslint directly and is unaffected.
• ESLint 4 and --ext after the path. The lockfile pins eslint 4.19.1. I installed 4.19.1 in the scratchpad and tested it: eslint ./src lints only a.js, while eslint ./src --ext .jsx,.js lints both a.js and b.jsx. So --ext works after the path.
• YAML. pr.yml parses cleanly with Ruby's YAML parser. The on: key loading as true is normal for GitHub workflows.

Non-blocking note: checkout@v3, setup-node@v3 and Node 14 are old and deprecated. That is inherited on purpose from build.yml, because the ticket requires identical steps, so it is not a defect in this change.

[paynejd]

Codex adversarial review, pass 1 (codex-cli 0.158, commit 53f7793)

Scope: origin/master...HEAD, including build.yml and the new pr.yml. Read-only run. The report below is verbatim.

Outcome: Clean.

---

No real issues found.

The lint jobs are structurally identical; build.yml, including deploy jobs, is unchanged. YAML parses successfully. PR concurrency is independent of the release group, and the manual-only build trigger prevents automatic double-runs. No repo callers conflict with the eslint script change.

The PR workflow references no secrets, grants only contents: read, and contains no push steps or pull_request_target, consistent with GitHub’s PR security model.

No files modified. Lint wasn’t executed; dependencies aren’t installed.