- Stack and pin policy (Node 24, npm 11, 30-day dep aging)
- Fork-specific convention: English commits (vs upstream-aligned)
- Coverage ratchet at 8% (only goes up)
- CI structure: Lint → Test → Security, build moved to release.yml
- Pointers to docs/ARCHITECTURE, DEVELOPMENT, CONTRIBUTING
- Sensitive areas flagged: fake-license shortcut in pro/account.ts,
large untested files (main.ts, settings.ts, pro/sync.ts)
The Lint → Test → Security pattern keeps each stage to a single concern.
`npm run build` belonged to test only to publish a PR-preview artifact;
release.yml already handles production builds, and developers can run
`npm run build` locally. Removing it from the test stage:
- aligns with code-standards/ci/pipeline-structure.md
- shaves ~70s off PR CI time
- removes the "dist" artifact upload (coverage upload stays)
- pro/src/account.ts: cast parens (}) as T; biome-ignore on intentional
unreachable code after fake-license shortcut
- pro/src/fsGoogleDrive.ts: let → const; missing semicolon; == → ===
(mimeType comparison and parent lookup)
- src/misc.ts: line break on long b.buffer.slice() chain
Bruno Miiller