refactor(lint): hard cut Devkit over to Oxlint

[norvalbv]

Summary

• Hard-cut Devkit’s own linting from Biome to native Oxlint: bun run lint, the self-host hook, and CI now invoke Oxlint only.
• Remove Devkit’s @biomejs/biome dependency, root self-host config, and the two fallback lint profiles. The package’s published biome/base and biome/react files remain only as temporary consumer compatibility paths; Devkit does not install or execute Biome.
• Keep the existing independent owners: Oxfmt formatting, ESLint filesystem topology/import walls, anti-slop’s baseline-aware Oxlint lane, and tsc type/build checks.
• Keep the narrow Oxlint allowance required by the newly merged comment-firewall test fixture; production no-useless-concat enforcement remains enabled.

Explicit policy decisions

This is a real self-host hard cutover, not a smaller duplicate Biome pass.

• Retire Biome’s JS useTopLevelRegex check: Oxlint 1.78 has no native equivalent, and a one-rule custom plugin would recreate the maintenance burden this change removes.
• Retire JSON duplicate-key and CSS-property diagnostics from Devkit CI: Oxlint does not lint those formats. Oxfmt still formats Devkit’s config/style files.
• Retire static import organisation as a lint responsibility. Oxfmt import sorting stays disabled because its output would be an unrelated 412-file rewrite.
• Preserve the published Biome presets until consumer/Frink migration has its own compatibility and performance evidence.

The decision record and the readable rationale are committed with the raw benchmark samples:
docs/benchmarks/experiments/2026-08-18-oxlint-native-devkit-adoption/.

Benchmark

Measured the real old and new bun run lint commands on macOS arm64, Node 24.19.0, Bun 1.3.1: three warm-ups, then ten alternating samples. Each side installs its locked dependencies in advance in an isolated tree; installation is excluded from the timing.

What you feel	Before	After	Improvement
CPU occupied by the check	2.41s	0.18s	92.5% less CPU
Time waiting for it to finish	0.41s	0.10s	74.5% faster
Peak command/process-tree memory	208 MiB	91 MiB	56.4% lower

CPU is the decision metric—the reduction frees capacity for local agents. Memory is recorded as a safety measure, not as a reason to reject the migration.

Validation

Post-rebase green:

• bun run format:check
• bun run lint (Oxlint only)
• bun run lint:structure
• bun run typecheck
• bun run build
• 29 targeted lint-policy, self-host, and comment-firewall tests
• both previously flaky process-reaping assertions when rerun in isolation
• GitNexus staged scope review: low risk; no changed execution symbols or affected flows

Known unrelated blockers, reported rather than hidden:

• Full bun run test:run completed with 3,889 passing / 5 skipped tests; two long-running process-reaping assertions fail only under parallel load and pass in isolation.
• bun run test:e2e has two pre-existing guard-fallow-staged bin-shim failures from current main (34 tests pass).
• bun run lint:anti-slop reports 22 inherited findings in untouched files under Shortcut #1788’s existing baseline-attribution issue. This PR does not rebaseline unrelated debt.

The normal pre-push gate cannot reach a clean terminal result because of those unrelated failures, so the rebased branch was pushed with the previously authorised no-verify exception.

[coderabbitai]

Warning

Review limit reached

@norvalbv, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 9 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a137724a-4ee7-4ce2-83d9-0687fa88cb84

📥 Commits

Reviewing files that changed from the base of the PR and between 76383ff and ff28c07.

⛔ Files ignored due to path filters (3)

• bun.lock is excluded by !**/*.lock
• dist/oxc/oxlint.devkit-lint.json is excluded by !**/dist/**
• dist/package.json is excluded by !**/dist/**

📒 Files selected for processing (10)

• .github/workflows/gate.yml
• biome.jsonc
• cli/__tests__/lint-policy.test.mts
• cli/__tests__/self-host.test.mts
• docs/benchmarks/experiments/2026-08-18-oxlint-native-devkit-adoption/README.md
• docs/benchmarks/experiments/2026-08-18-oxlint-native-devkit-adoption/benchmark.mjs
• docs/benchmarks/experiments/2026-08-18-oxlint-native-devkit-adoption/results.json
• docs/decisions/oxc-toolchain-migration.md
• oxc/oxlint.devkit-lint.json
• package.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}