[PM-24643] Add an easy to use formatting linting command to the sdk by coroiu · Pull Request #1140 · bitwarden/sdk-internal

coroiu · 2026-05-26T09:13:42Z

🎟️ Tracking

📔 Objective

Makes linting easier by using the same script for CI and local checks
Makes linting faster in CI (17m -> 8m) by parallelizing the checks

🚨 Breaking Changes

Introduce scripts/lint.sh as the single source of truth for the formatting and linting checks the SDK requires. Mirrors the checks in .github/workflows/lint.yml so a local run matches CI. The script supports --fix (auto-fix where supported) and --only <name> (run a single check), and is wired into package.json: - npm run lint - check-only, matches CI - npm run lint:fix - auto-fix what can be auto-fixed - npm run lint:prettier (the previous prettier-only `npm run lint`) The CI workflow is otherwise unchanged in this commit; only the `Node Lint` step is updated to call lint:prettier under its new name. A follow-up commit refactors CI to call scripts/lint.sh directly.

Each check that used to be a sequential step in the `style` job is now its own matrix entry, calling `./scripts/lint.sh --only <name>`. The script remains the single source of truth for what each check does; this workflow only handles toolchain/tool installation gated on the matrix entry's needs. `fail-fast: false` mirrors the previous "let every check finish so you see all the failures" behaviour. Net effect: wall-clock is bounded by the slowest single check (udeps or clippy) rather than their sum. The clippy job still produces SARIF output for the GitHub Security tab; that step runs before `--only clippy` so the script's clippy run hits the warm cache. Also switch the script's `cargo-lock` check from `git diff Cargo.lock` to `cargo metadata --locked`. The diff-based check only catches drift when a prior step in the same job updated Cargo.lock, which no longer holds in matrix isolation. `--locked` checks lockfile-vs-Cargo.toml consistency directly.

Replace the hand-typed checks list in README § Formatting & Linting with a pointer to `npm run lint` / `npm run lint:fix` and the `--only <check>` selector. The list of tools and pinned versions remains in lint.yml; the README no longer re-asserts the exact commands and so cannot drift from CI. Update .claude/CLAUDE.md Format & Lint bullets to point at the same commands.

github-advanced-security · 2026-05-26T09:16:25Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-actions · 2026-05-26T09:19:14Z

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR introduces a unified scripts/lint.sh runner (with npm run lint / npm run lint:fix aliases), refactors .github/workflows/lint.yml into a parallel matrix gated by a stable Check Style job, tracks cargo-sort and cargo-udeps versions through Renovate, widens the prettier ignore glob to cover all wasm-pack output under bitwarden-wasm-internal, and updates README.md / .claude/CLAUDE.md to point at the new commands. The change is scoped to developer tooling and CI orchestration — no SDK runtime, crypto, or data-handling code is touched.

The script faithfully mirrors the previous CI steps (same flags, same RUSTFLAGS/RUSTDOCFLAGS, same nightly toolchain extraction), with a deliberate improvement: the cargo-lock check now uses cargo metadata --locked rather than git diff --exit-code Cargo.lock, which works in isolation without a prior cargo run and is documented inline. The matrix uses fail-fast: false so all checks surface their results, and the Check Style job correctly fails when any matrix leg is not success. Pre-existing review feedback (matrix key naming, Renovate coverage for the new pinned versions) has already been addressed.

Code Review Details

No actionable findings.

github-actions · 2026-05-26T09:22:22Z

🔍 SDK Breaking Change Detection

SDK Version: PM-24643-add-an-easy-to-use-formatting-linting-command-to-the-sdk (bdd43df)

⚠️ If breaking changes are detected, a corresponding pull request addressing them must be ready for merge in the affected client repository.

Client	Status	Details
typescript	✅ No breaking changes detected	Compilation passed with new SDK version - View Details
android	✅ No breaking changes detected	Compilation passed with new SDK version - View Details

Breaking change detection uses the build of the SDK from this branch, including any incompatibities pre-existing on or merged into this branch. Check the workflow logs to confirm.
Results update as workflows complete.

codecov · 2026-05-26T09:41:54Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.10%. Comparing base (a635e32) to head (847df0d).
⚠️ Report is 13 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1140      +/-   ##
==========================================
+ Coverage   83.85%   84.10%   +0.25%     
==========================================
  Files         437      445       +8     
  Lines       56704    58746    +2042     
==========================================
+ Hits        47547    49410    +1863     
- Misses       9157     9336     +179

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The existing entries only covered `*_bg.wasm.js`, missing the companion `bitwarden_wasm_internal.js`, `*_bg.js`, and the `node/` subdirectory variant that wasm-pack also emits. Locally those files made `npm run lint` noisy after a wasm build; CI never saw them because they're git-untracked, but the new unified lint command surfaced the gap. Collapse both lines to a single `**/bitwarden_wasm_internal*.js` glob under `crates/bitwarden-wasm-internal/`. Tracked files in those directories (`index.js`, `package.json`, etc.) keep being checked since the prefix doesn't match them.

withinfocus

The AI changes are fine, but a couple things too.

Also, see bitwarden/template#199 -- you don't have to use NPM as your linting gateway if you don't want to; the latest Git's hooks feature can be used for that and would be my preference for all new work.

Hinton · 2026-05-26T12:47:24Z

Windows support?

Is that a thing we do?

Also bash can be available on windows too

Yes, all other projects runs on both windows and mac. Several of our developers use windows and we want to support external contributors. I don't think bash is generally available on windows unless you use WSL or git bash which I'm not sure we can assume?

What about just using a node script or powershell which is what we use in other places.

Just a note, we require devs to install powershell on linux/mac for server development, so requiring them to install bash on windows seems reasonable.

Does git even work without bash? I think it's pretty safe to assume that bash exists on windows since it's a core component of git for windows. There are scaled down versions like MinGit that don't come with bash but MinGit is a lightweight, non-interactive distribution of Git for Windows, designed specifically for third-party applications like IDEs and graph visualizers, so I think we can safely scope that out.

Unless support for Bash and Powershell is a general requirement we have documented somewhere that I've missed?

Doesn't IDEs imply we break commit flows in IDEs?

Powershell is a documented requirement, used in both server and browser extension, bash is not currently required on windows.

At a minimum we should test to ensure this works on windows.

Thanks for the call out, we should definitely work to have all SDK tooling work across platforms. Considering bash is the current standard in the SDK I don't think we should block this work over it. I've added this ticket to the top of the Platform backlog for converting this script and others to powershell/ts/something else.

Pairs naturally with `needs_rust`; review nit from withinfocus.

The existing Renovate custom regex manager covered cargo-dylint and dylint-link installs in workflows; cargo-sort and cargo-udeps were not tracked. Extend the matchStrings to pick them up and add both to the platform-team review/commit-prefix list to mirror how cargo-dylint is owned. Answers withinfocus's "how are these versions monitored" question on the lint workflow.

coroiu · 2026-05-27T07:11:08Z

@withinfocus npm is mostly just used as a convenient way of running the bash script, and couldn't remove it even if we wanted to because we have javascript components that are linted using prettier. We could definitely change how git hooks are applied, but this PR deliberately doesn't touch the git hooks at all so I'd prefer to follow that up in a separate PR if we think it's something critical

withinfocus · 2026-05-27T13:04:17Z

this PR deliberately doesn't touch the git hooks at all so I'd prefer to follow that up in a separate PR if we think it's something critical

That's fine, just something to keep in mind as an improvement.

withinfocus · 2026-05-27T13:04:57Z

You might need some admin help with merging this since you renamed a required check.

sonarqubecloud · 2026-06-02T07:54:27Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coroiu · 2026-06-02T09:06:27Z

@withinfocus Fixed without admin permissions, thanks for pointing me in the right direction!

… easy to use formatting linting command to the sdk (bitwarden/sdk-internal#1140)

coroiu added 3 commits May 26, 2026 11:03

coroiu added the ai-review Request a Claude code review label May 26, 2026

coroiu marked this pull request as ready for review May 26, 2026 09:41

coroiu requested review from a team as code owners May 26, 2026 09:41

coroiu requested a review from dereknance May 26, 2026 09:41

withinfocus reviewed May 26, 2026

View reviewed changes

Comment thread .github/workflows/lint.yml Outdated

Comment thread .github/workflows/lint.yml

Hinton reviewed May 26, 2026

View reviewed changes

coroiu added 2 commits May 27, 2026 08:22

[PM-24643] Rename matrix key to needs_rust_nightly

67d5eb8

Pairs naturally with `needs_rust`; review nit from withinfocus.

coroiu requested a review from withinfocus May 27, 2026 07:11

withinfocus previously approved these changes May 27, 2026

View reviewed changes

dereknance previously approved these changes May 27, 2026

View reviewed changes

[PM-24643] Gate lint matrix behind a stable Check Style job

847df0d

coroiu dismissed stale reviews from dereknance and withinfocus via 847df0d June 2, 2026 07:47

coroiu requested review from dereknance and withinfocus June 2, 2026 09:05

addisonbeck approved these changes Jun 2, 2026

View reviewed changes

withinfocus approved these changes Jun 2, 2026

View reviewed changes

coroiu merged commit 7bca9fc into main Jun 2, 2026
85 checks passed

coroiu deleted the PM-24643-add-an-easy-to-use-formatting-linting-command-to-the-sdk branch June 2, 2026 13:32

bw-ghapp Bot added a commit to bitwarden/sdk-swift that referenced this pull request Jun 2, 2026

bitwarden/sdk-internal@7bca9fc 3.0.0-6510-7bca9fc - [PM-24643] Add an…

c6ddb2d

… easy to use formatting linting command to the sdk (bitwarden/sdk-internal#1140)

This was referenced Jun 2, 2026

Update SDK to c6ddb2d (3.0.0-6510-7bca9fc) bitwarden/ios#2722

Merged

Update SDK to 3.0.0-7198-7bca9fca bitwarden/android#6983

Merged

coroiu mentioned this pull request Jun 10, 2026

[PM-38767] Adopt cargo-run-bin for binary tool version pinning in desktop_native bitwarden/clients#21169

Draft

Conversation

coroiu commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎟️ Tracking

📔 Objective

🚨 Breaking Changes

Uh oh!

github-advanced-security AI commented May 26, 2026

What Enabling Code Scanning Means:

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bitwarden Claude Code Review

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 SDK Breaking Change Detection

Uh oh!

codecov Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

withinfocus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Hinton May 26, 2026

Choose a reason for hiding this comment

Uh oh!

coroiu May 26, 2026

Choose a reason for hiding this comment

Uh oh!

coroiu May 26, 2026

Choose a reason for hiding this comment

Uh oh!

Hinton May 26, 2026

Choose a reason for hiding this comment

Uh oh!

quexten May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coroiu May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Hinton Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

addisonbeck Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coroiu commented May 27, 2026

Uh oh!

withinfocus commented May 27, 2026

Uh oh!

withinfocus commented May 27, 2026

Uh oh!

sonarqubecloud Bot commented Jun 2, 2026

Quality Gate passed

Uh oh!

coroiu commented Jun 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

coroiu commented May 26, 2026 •

edited

Loading

github-actions Bot commented May 26, 2026 •

edited

Loading

github-actions Bot commented May 26, 2026 •

edited

Loading

codecov Bot commented May 26, 2026 •

edited

Loading

quexten May 27, 2026 •

edited

Loading

Hinton Jun 2, 2026 •

edited

Loading

addisonbeck Jun 2, 2026 •

edited

Loading