Decide whether to pin knip as a devDependency and wire it into CI

[coderabbitai]

Background

PR #555 added knip.jsonc for ad-hoc dead-code analysis (run via npx knip), but intentionally did not wire knip into CI. The reason: this repo SHA-pins all GitHub Actions workflow steps, and adding an unpinned npx knip invocation would be a supply-chain regression.

Tracking comment: #555 (comment)

Decision needed

A maintainer decision is required on whether to add knip as a pinned devDependency (with a full lockfile entry and defined upgrade cadence).

Planned follow-up (once the decision lands)

1. Add knip as a devDependency — pin to the current validated version (6.16.1) and update package-lock.json.
2. Add an npm script in package.json:

   "knip": "knip"

3. Add a non-concurrent CI step in the relevant workflow(s) — must run before any step that mutates dist/ (i.e., before the build step) to avoid races with dist writes. Use npm run knip (windows-safe, no bare glob expansion).
4. Extend test/ci-workflows.test.ts (see test/ci-workflows.test.ts:39-50 and test/ci-workflows.test.ts:63-81) to assert the knip script is invoked in both the linux validate job and the windows scripts-windows expectations.

References

• PR chore: add a tuned knip config and drop the unused @fast-check/vitest #555 — adds knip.jsonc config
• test/ci-workflows.test.ts — existing CI regression guard
• .github/workflows/ — workflow files to update

[coderabbitai]

🔗 Related PRs

#36 - chore(dx): unify local and CI verify pipeline [merged]
#66 - ci(actions): add dedicated pull request workflow [merged]
#342 - mirror release harness checks on push CI [merged]
#458 - Fix npm bin collision with official Codex [merged]
#528 - chore(deps): pin @types/node to the supported runtime floor major [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!