feat: Add ESLint and Oxlint plugin

.changeset/README.md

@@ -1,9 +1,12 @@
 # Changesets
 
-Use `bun run changeset` in PRs that affect the published `sideffect` package.
+Use `bun run changeset` in PRs that affect either published Sideffect package:
+
+- `sideffect`
+- `@sideffect/lint`
 
 Use `bun run changeset:status` to inspect pending release notes.
 
-Use `bun run changeset:version` to prepare a release commit that updates `packages/sideffect/package.json` and `packages/sideffect/CHANGELOG.md`.
+Use `bun run changeset:version` to prepare a release commit. `sideffect` and `@sideffect/lint` are a fixed release set and must keep the same version number.
 
-Publishing is explicit: manually dispatch the publish workflow and type the exact `publish sideffect@<version>` confirmation.
+Publishing is explicit: manually dispatch the publish workflow and type the exact `publish sideffect@<version> and @sideffect/lint@<version>` confirmation.

.changeset/config.json

@@ -2,7 +2,7 @@
   "$schema": "https://unpkg.com/@changesets/config/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
-  "fixed": [],
+  "fixed": [["sideffect", "@sideffect/lint"]],
   "linked": [],
   "access": "public",
   "baseBranch": "main",

.changeset/soft-ravens-lint.md

@@ -0,0 +1,5 @@
+---
+"@sideffect/lint": patch
+---
+
+Add ESLint and Oxlint rules for Cloudflare Workflows and Sideffect workflow syntax.

.github/workflows/lint.yml

@@ -0,0 +1,27 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install deps
+        run: bun install --frozen-lockfile
+
+      - name: Check
+        run: bun run check

.github/workflows/publish.yml

@@ -4,10 +4,10 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Exact sideffect version to publish, e.g. 0.2.2
+        description: Exact Sideffect release-set version to publish, e.g. 0.2.2
         required: true
       confirm:
-        description: Type publish sideffect@<version>
+        description: Type publish sideffect@<version> and @sideffect/lint@<version>
         required: true
       npm_tag:
         description: npm dist-tag
@@ -47,11 +47,19 @@ jobs:
           INPUT_CONFIRM: ${{ inputs.confirm }}
           INPUT_VERSION: ${{ inputs.version }}
         run: |
-          package_version="$(node -p "require('./packages/sideffect/package.json').version")"
-          expected_confirm="publish sideffect@${package_version}"
+          sideffect_version="$(node -p "require('./packages/sideffect/package.json').version")"
+          lint_version="$(node -p "require('./packages/lint-plugin/package.json').version")"
+
+          if [ "${sideffect_version}" != "${lint_version}" ]; then
+            printf 'Refusing to publish: packages/sideffect/package.json version "%s" does not match packages/lint-plugin/package.json version "%s". Run bun run changeset:version and commit the generated release changes before publishing.\n' "${sideffect_version}" "${lint_version}" >&2
+            exit 1
+          fi
+
+          package_version="${sideffect_version}"
+          expected_confirm="publish sideffect@${package_version} and @sideffect/lint@${package_version}"
 
           if [ "${INPUT_VERSION}" != "${package_version}" ]; then
-            printf 'Refusing to publish: workflow input version "%s" does not match packages/sideffect/package.json version "%s". Run bun run changeset:version and dispatch this workflow with the exact package version.\n' "${INPUT_VERSION}" "${package_version}" >&2
+            printf 'Refusing to publish: workflow input version "%s" does not match the Sideffect release-set version "%s". Run bun run changeset:version and dispatch this workflow with the exact package version.\n' "${INPUT_VERSION}" "${package_version}" >&2
             exit 1
           fi
 
@@ -71,35 +79,37 @@ jobs:
             exit 1
           fi
 
+          if npm view "@sideffect/lint@${package_version}" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
+            printf 'Refusing to publish: @sideffect/lint@%s already exists on npm. The registry was not changed.\n' "${package_version}" >&2
+            exit 1
+          fi
+
       - name: Install deps
         run: bun install --frozen-lockfile
 
-      - name: Check sideffect
-        working-directory: packages/sideffect
+      - name: Check packages
         run: bun run check
 
-      - name: Test sideffect
-        working-directory: packages/sideffect
+      - name: Test packages
         run: bun run test
 
-      # Build before publish so npm validates package.json after bin targets exist.
-      - name: Build sideffect
-        working-directory: packages/sideffect
+      # Build before publish so npm validates package.json after package outputs exist.
+      - name: Build packages
         run: bun run build
 
       - name: Run Cloudflare workflow E2E
         run: bun run test:e2e
 
-      - name: Pack sideffect
-        working-directory: packages/sideffect
+      - name: Pack release set
         run: |
-          mkdir -p ../../release-artifacts
-          npm pack --pack-destination ../../release-artifacts
+          mkdir -p release-artifacts
+          npm pack ./packages/sideffect --pack-destination release-artifacts
+          npm pack ./packages/lint-plugin --pack-destination release-artifacts
 
       - uses: actions/upload-artifact@v4
         with:
-          name: sideffect-package
-          path: release-artifacts/sideffect-*.tgz
+          name: sideffect-packages
+          path: release-artifacts/*.tgz
           if-no-files-found: error
           retention-days: 1
 
@@ -119,11 +129,23 @@ jobs:
 
       - uses: actions/download-artifact@v4
         with:
-          name: sideffect-package
+          name: sideffect-packages
           path: release-artifacts
 
-      - name: Publish sideffect (OIDC, no token)
+      - name: Publish release set (OIDC, no token)
         env:
           INPUT_VERSION: ${{ inputs.version }}
           NPM_TAG: ${{ inputs.npm_tag }}
-        run: npm publish "release-artifacts/sideffect-${INPUT_VERSION}.tgz" --provenance --tag "${NPM_TAG}" --ignore-scripts
+        run: |
+          if npm view "sideffect@${INPUT_VERSION}" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
+            printf 'Refusing to publish: sideffect@%s already exists on npm. The registry was not changed.\n' "${INPUT_VERSION}" >&2
+            exit 1
+          fi
+
+          if npm view "@sideffect/lint@${INPUT_VERSION}" version --registry=https://registry.npmjs.org >/dev/null 2>&1; then
+            printf 'Refusing to publish: @sideffect/lint@%s already exists on npm. The registry was not changed.\n' "${INPUT_VERSION}" >&2
+            exit 1
+          fi
+
+          npm publish "release-artifacts/sideffect-${INPUT_VERSION}.tgz" --provenance --tag "${NPM_TAG}" --ignore-scripts
+          npm publish "release-artifacts/sideffect-lint-${INPUT_VERSION}.tgz" --provenance --tag "${NPM_TAG}" --ignore-scripts

.github/workflows/test.yml

@@ -23,12 +23,8 @@ jobs:
       - name: Install deps
         run: bun install --frozen-lockfile
 
-      - name: Build sideffect
-        working-directory: packages/sideffect
+      - name: Build packages
         run: bun run build
 
-      - name: Check
-        run: bun run check
-
       - name: Test packages
         run: bun run test