ci(lint): report oxlint exceptions on every run

[kianbazza]

Summary

bun run lint:exceptions lists every lint exception in packages/react. CI runs it after oxlint, even if oxlint failed, and adds the list to the job summary.

Lint exceptions in packages/react: 50 allowlist entries across 46 file(s), 1 inline.

Allowlisted files, by rule (fix a file, then delete its line in .oxlintrc.json):
  bazza/context-hook-contract (7)
    packages/react/src/combobox/contexts/combobox-positioner-context.ts
    …
Rules turned off by pattern:
  packages/react/src/**/*.test.{ts,tsx}: bazza/context-hook-contract, bazza/forward-ref-named, …
Inline exceptions:
  …/data-list.tsx:396  react-hooks/exhaustive-deps  -- (no reason)  (allowlisted) this repo has no ESLint, …

• When it fails: only on a malformed exception, meaning no rule named, no reason, a file-wide bazza/* exception, or eslint-disable. Everything else is informational, a burn-down list.
• Why this check lives in a script: a bare /* oxlint-disable */ on a file's first line silences every rule, including bazza/disable-needs-reason, which is the rule meant to report it. This script reads the text, so nothing can silence it.
• One exemption: a stale eslint-disable in a file already allowlisted for bazza/disable-needs-reason is listed but doesn't fail, because oxlint ignores eslint-* comments. A malformed oxlint-disable fails even in that file.
• What gets scanned: comments are read by a small tokenizer (tooling/lint/source-text.ts) that skips strings and template literals and copes with apostrophes in JSX text. The same module parses .oxlintrc.json as JSONC for both the report and the lint tests.

Evidence

• Before: a tracked packages/react file whose first line is /* oxlint-disable */ passed bun run check and CI, with every rule silenced for the whole file.
  After:

  $ bun run lint:exceptions
    packages/react/src/a.tsx:1  (all rules)  -- (no reason)  ✗ a lint exception must name the rule it disables: …
  1 lint exception(s) aren't acceptable; see ✗ above and "Lint" in packages/react/AGENTS.md.
  error: script "lint:exceptions" exited with code 1
  

  The report also fails for the same comment appended to the allowlisted data-list.tsx, and after <p>Don't</p> on the same line. On the current tree it exits 0.
• The tooling/lint tests grow to 73. They cover the tokenizer (URLs, globs, template literals, JSX apostrophes, unclosed quotes, escaped newlines), JSONC parsing, allowlist and pattern detection (including the 'allow', 0 and ['off', …] levels), the exemption rule, and a check that every allowlisted file in the repo config exists.

Merge Danger

Door: two-way

Blast Radius: CI

This adds one CI step. It fails a PR only when that PR adds a malformed lint exception comment in packages/react.

Closes UI-619

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ui-canary	Ready	Preview	Sep 29, 2026 3:09pm UTC

[linear-code]

UI-619