Clear the two Biome warnings in scripts/

[dchaudhari7177]

Closes #60. npx biome check . reports zero warnings and zero errors.

1. check-dependencies.mjs — optional chain

-      } else if (!policy.allowed[dep] && !(policy.allowedDev ?? {})[dep]) {
+      } else if (!policy.allowed[dep] && !policy.allowedDev?.[dep]) {

Your equivalence argument holds, and I checked it rather than took it on trust: ?? substitutes only for null/undefined, ?. short-circuits on exactly those two, and for any other type the index lookup yields undefined either way. allowedDev is read from dependency-policy.json, so it is an object or absent. The unsafe flag is Biome not knowing that in general — it is not a doubt about this call site.

2. check-npmrc.mjs — dead suppression

Directive gone, prose kept. I also folded your finding into the comment:

/** The only accepted form: an environment reference, optionally surrounded by whitespace. */
// The ${...} here is literal .npmrc syntax, not a JS template placeholder.
// (No biome-ignore needed: noTemplateCurlyInString does not inspect regex
// literals, so the directive that used to sit here suppressed nothing. It
// would be needed again if this were ever rewritten as a string.)
const ENV_REFERENCE = /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/

Without that second half, the next reader sees a comment about .npmrc syntax and no reason the suppression is absent — and your caveat about the string rewrite is exactly the thing that would otherwise have to be rediscovered.

Done when

• npx biome check . reports zero warnings and zero errors
• scripts/check-dependencies.mjs uses the optional-chain form, and still passes on the current tree
• The dead biome-ignore is gone and the prose explanation is retained
• node scripts/check-npmrc.mjs still fails on a literal token
• npm run verify exits 0

The guard demonstrated failing rather than presumed to, per L8:

$ printf '//registry.npmjs.org/:_authToken=npm_literalSecretToken...\n' > .npmrc
$ node scripts/check-npmrc.mjs; echo "exit=$?"
.npmrc contains a credential that is not an environment reference:

  line 1: value must be exactly ${VARIABLE}
    //registry.npmjs.org/:_authToken=<redacted>

Use ${WEBAWESOME_NPM_TOKEN}. See CONTRIBUTING.md.
exit=1

and the accepting case, so the exit 1 above is not a gate that rejects everything:

$ printf '//registry.npmjs.org/:_authToken=${WEBAWESOME_NPM_TOKEN}\n' > .npmrc
$ node scripts/check-npmrc.mjs; echo "exit=$?"
.npmrc: ok (credentials reference the environment only)
exit=0

The repository's own .npmrc was restored afterwards, byte for byte.

npm run verify: exit 0 — deps ok (6 manifests), npmrc ok, biome clean, tsc --build clean, 127 tests passing.

One note for anyone reproducing on Windows

Without core.autocrlf=false, Biome reports every file in scripts/ as a formatting error before any change is made — the working copy is CRLF and the index is LF. It is a local checkout artefact, not a repo state, but it buries the two real warnings completely. Both blobs in this PR are committed LF (git ls-files --eol confirms i/lf w/lf).

The remaining biome migrate info is pre-existing and untouched — the issue asks for zero warnings and zero errors, and I read that as leaving the info alone rather than pulling a config migration into this PR. Say the word if you want it here instead.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 88b33b96-47cb-4a8f-b999-8102257c24a1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}