ci: run ESLint in CI to enforce the @objectstack/spec import guard

.github/workflows/lint.yml

@@ -9,6 +9,47 @@ on:
       - main
 
 jobs:
+
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v5
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-v3-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Enforces the no-restricted-imports guard against @objectstack/spec root
+      # namespace imports (the dormant rule was never run in CI). Syntactic
+      # only, so no build step needed.
+      - name: ESLint
+        run: pnpm lint
+
   typecheck:
     name: TypeScript Type Check
     runs-on: ubuntu-latest

eslint.config.mjs

@@ -1,5 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
+import tsParser from '@typescript-eslint/parser';
+
 // Flat ESLint config — guards against memory-bloating import patterns.
 //
 // Background: `export * as Namespace from './sub'` is NOT tree-shakeable in
@@ -9,7 +11,13 @@
 // in `@objectstack/objectos`. Those root barrels are gone — this rule prevents
 // them coming back via consumer imports.
 //
-// To enable: `pnpm add -DW eslint` then `pnpm exec eslint .`
+// Wired into CI via the root `lint` script (.github/workflows/lint.yml).
+// Run locally with `pnpm lint`. The script passes `--no-inline-config`:
+// source files carry orphaned `eslint-disable` directives for a richer rule
+// set this config does not register (a fuller setup was stripped to this
+// import guard), and the flag ignores them so the guard runs clean. The only
+// active rule (no-restricted-imports) should never need a local opt-out — it
+// prevents a ~1.2GB RSS regression.
 
 const SUBPATH_NAMES = [
   'Data', 'UI', 'System', 'AI', 'API', 'Automation',
@@ -40,6 +48,10 @@ export default [
       'packages/cli/src/commands/create.ts',
       'packages/create-objectstack/src/index.ts',
     ],
+    languageOptions: {
+      parser: tsParser,
+      parserOptions: { ecmaVersion: 'latest', sourceType: 'module' },
+    },
     rules: {
       'no-restricted-imports': ['error', {
         paths: [{

package.json

@@ -23,7 +23,8 @@
     "objectui:build": "bash scripts/build-console.sh",
     "objectui:bump": "bash scripts/bump-objectui.sh",
     "objectui:refresh": "bash scripts/bump-objectui.sh && bash scripts/build-console.sh",
-    "objectui:clean": "rm -rf packages/console/dist .cache/objectui-*"
+    "objectui:clean": "rm -rf packages/console/dist .cache/objectui-*",
+    "lint": "eslint . --no-inline-config"
   },
   "keywords": [
     "objectstack",
@@ -37,6 +38,8 @@
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
     "@types/node": "^25.9.3",
+    "@typescript-eslint/parser": "^8.61.1",
+    "eslint": "^10.5.0",
     "tsup": "^8.5.1",
     "tsx": "^4.22.4",
     "turbo": "^2.9.18",