Repository navigation
Add hermetic config-schema validation for JSON and YAML files - #54
Open
CallumHoward wants to merge 1 commit into
Open
CallumHoward wants to merge 1 commit into
CallumHoward wants to merge 1 commit into
Conversation
CallumHoward
changed the title
CallumHoward
force-pushed
the
claude/great-meitner-510jzd
branch
from
June 24, 2026 10:07
302a2a8 to
929d6b9
Compare
CallumHoward
commented
Jun 24, 2026
A static gate validates every tracked config file that references a
schema, wired into CI and the pre-commit hook. Validation is hermetic:
schemas are vendored in-repo and resolved offline, so it never hits the
network at check time and stays deterministic.
- scripts/validate-schemas.ts (`pnpm validate:schemas`): Ajv-based
validator (draft-04 .. 2020-12). JSON/JSONC use a top-level "$schema";
YAML uses a `# yaml-language-server: $schema=` modeline or top-level
key. Resolves refs to vendored copies under schemas/ via manifest.json.
- Vendored schemas under schemas/ are themselves meta-validated against
their declared dialect (Ajv ships the meta-schemas, so still hermetic),
catching a corrupted or mis-edited vendored copy.
- scripts/update-schemas.ts (`pnpm schemas:update`): the only networked
step; refreshes vendored copies for review.
- $schema/modelines added to tsconfig, public/manifest.json,
.claude/settings.json, GitHub workflows, lefthook, dependabot,
pnpm-workspace.
- deps: ajv*, jsonc-parser, yaml (added to fallow ignoreDependencies);
scripts/** excluded from fallow; schemas/** excluded from oxfmt.
- CI step "Validate config schemas"; pre-commit job over staged
*.{json,jsonc,yml,yaml}.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01B8LKH5sijopQWNJtzqBTN4
CallumHoward
force-pushed
the
claude/great-meitner-510jzd
branch
from
September 27, 2026 09:32
929d6b9 to
66fef06
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a hermetic gate that validates every tracked config file referencing a schema, in CI and pre-commit. Schemas are vendored, so checks run offline and don't flake when upstream changes.
How it works
"$schema"(JSON/JSONC), a# yaml-language-server: $schema=modeline, or a$schema:key (YAML).schemas/manifest.jsonmaps each schema URL to a vendored copy underschemas/. Nothing is fetched at check time.yaml) and validated with Ajv, draft-04 through 2020-12, picked from the schema.pnpm schemas:updateis the only networked step. It refreshes the vendored copies as a reviewable diff.Files validated (9, all pass)
.fallowrc.jsontsconfig.jsonpublic/manifest.json.claude/settings.json.github/workflows/ci.yml,update-pnpm.ymllefthook.yml.github/dependabot.ymlpnpm-workspace.yamlpnpm-lock.yamland files without a schema reference are skipped..mcp.json,.cta.jsonand.vscode/settings.jsonhave no stable published schema, so they're left alone.Key files
scripts/validate-schemas.ts(pnpm validate:schemas) andscripts/update-schemas.ts(pnpm schemas:update)schemas/: manifest plus vendored copiesci.yml"Validate config schemas" step;lefthook.ymlpre-commit job over staged*.{json,jsonc,yml,yaml}.fallowrc.json: excludesscripts/**and ignoresajv*,jsonc-parser,yamlRebased onto
mainafter #78/#82/#85; full suite andvalidate:schemaspass.🤖 Generated with Claude Code