feat(workspace-config): biome-linter rule — fleet tracks one biome version

[mabry1985]

What

Adds a workspace-config standard rule so the fleet tracks one biome version together — bump it in a single place and every JS/TS repo that's behind gets flagged in CI, instead of biome drifting per-repo.

• FLEET_BIOME_VERSION (lib/workspace-config.mjs) — the single source of truth for the biome version the fleet tracks (currently 2.4.16, matching protoWorkstacean + release-tools).
• biome-linter rule (warn): a repo with a package.json must depend on @biomejs/biome at FLEET_BIOME_VERSION and carry a biome.json/biome.jsonc. The detail line names the exact gap:
  • no @biomejs/biome dep → still on ESLint, or unlinted
  • dep present but no biome.json
  • version differs from the fleet pin → version drift
• N/A for non-node repos (Python, Rust — no package.json) → never fires there.
• both manifest builders (local + remote/gh api) now expose packageJson and resolve biome.json/biome.jsonc; cleanVersion + biomeVersion helpers exported.

warn (not error) for rollout — same posture as workflow-security-lint; tighten to error once every node repo is on biome.

How the fleet moves together

Bump FLEET_BIOME_VERSION here → protoWorkstacean's fleet-config-audit (which runs verify-workspace-config --repo across every watched repo) flags everyone behind. Single bump, fleet-wide signal.

Verification

• npm test — 60 pass / 0 fail (9 new: cleanVersion, biomeVersion, N/A, pass-on-fleet-version, no-dep warn, no-config warn, version-drift warn, biome.jsonc)
• biome lint . clean; npm run smoke OK
• self-audit (verify-workspace-config) — conformant (release-tools is on biome 2.4.16)
• docs: reference/workspace-config-standard.md updated (table row + rationale)

Follow-up

The fleet-config-audit consumes github:protoLabsAI/release-tools (main), so this is live for the fleet audit on merge. A release-tools version bump/release would surface it to npm @protolabsai/release-tools consumers too.

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #43 | feat(workspace-config): biome-linter rule — fleet tracks one biome version

VERDICT: INCONCLUSIVE — CI pending

---

CI Status

• Lint + smoke test: queued ⏳

Diff Review

• bin/verify-workspace-config.mjs: localManifest and remoteManifest both gain packageJson (parsed or null). Graceful null on missing/not-a-node-repo. remoteManifest also adds biome.json/biome.jsonc to its presence-check set — correct.
• lib/workspace-config.mjs: FLEET_BIOME_VERSION = '2.4.16', cleanVersion, biomeVersion helpers exported. New biome-linter rule (warn): skips non-node repos via !m.packageJson guard, checks dep presence → config presence → version match via cleanVersion. Detail lines are clear and actionable. fix command embeds the fleet pin inline — good.
• docs/reference/workspace-config-standard.md: Table row added, rationale section covers non-node N/A and the upgrade flow.
• test/workspace-config.test.mjs: 9 new cases covering N/A, pass-on-fleet-version, no-dep warn, no-config warn, version-drift warn, and biome.jsonc. Helper nodeManifest is clean.

Structural review (clawpatch)

• Unavailable (gateway 502 on branch ref). Manual review substituted.

Observations

• LOW: remoteManifest uses gh api fallback to null silently on any error — including a transient network failure, not just "file absent." The behavior is intentionally lenient (non-node repos have no package.json on GitHub), but worth noting: a 403 on a private repo would also silently fall through. Unlikely to matter for this tool's fleet context, but documented.
• MEDIUM/INFO: WORKFLOW_SECURITY_LINT_PATH is imported in tests but unused in the diff — likely pre-existing dead import.

CodeRabbit

• No unresolved threads.

---

CI must reach a terminal state before a formal PASS/FAIL verdict is issued. Will re-review once Lint + smoke test completes.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on protoLabsAI/release-tools#43 — CI was still queued at inspection time, so a formal verdict (PASS/FAIL) is reserved until checks are terminal. The diff itself is well-structured: FLEET_BIOME_VERSION is a clean single-source pin, the biome-linter rule correctly gates on packageJson presence (making it N/A for Python/Rust), and the detail lines are specific enough to drive action. No blocking issues identified in the code.

[protoquinn]

CI terminal-green, no blockers on prior review — auto-approving on green (#748).