feat(tooling): add ReSharper staged-files gate, expand audit umbrella

- `npm run audit` now includes the ReSharper inspectcode pass and
  takes several minutes; use the per-tool scripts (`audit:fallow`,
  `audit:dupes`, `audit:resharper`) for fast iteration.

Author: rlorenzo

README.md

@@ -179,6 +179,24 @@ The project includes VS Code launch configurations for debugging both frontend a
 - `npm run lint:staged` - Lint only git-staged files
 - `npm run precommit` - Run full pre-commit checks manually (lint, test, build verify)
 
+### Auditing (regression detection)
+
+Heavier whole-project scanners that surface dead code, duplication, and C# inspection findings that the per-file linter doesn't catch. Outputs land in gitignored report directories (`.fallow/`, `jscpd-report/`, `inspect-report/`).
+
+**Whole-project scans** — run locally for human review:
+
+- `npm run audit` - Run all whole-project audits (fallow + jscpd + ReSharper); takes several minutes due to the ReSharper scan
+- `npm run audit:fallow` - Vue/TS dead code, unused exports, complexity, duplication (`VueApp/`)
+- `npm run audit:dupes` - jscpd duplicate-code report across `VueApp/src/` and `web/Areas/`
+- `npm run audit:resharper` - ReSharper `inspectcode` whole-solution scan (writes SARIF + HTML to `inspect-report/`); takes several minutes
+
+**Diff-scoped gates** — fail only on *new* findings at touched lines, so pre-existing issues never block:
+
+- `npm run audit:resharper:pr` - C# inspection gate vs `origin/main`. Same gate the `Code Quality` GitHub Actions workflow runs on PRs.
+- `npm run audit:resharper-staged` - C# inspection gate vs the git index (`git diff --cached`). Useful as a manual pre-commit check. For fast iteration after one full scan, append `-- --skip-scan` to reuse the existing SARIF: `npm run audit:resharper-staged -- --skip-scan`.
+
+**CI integration** — `.github/workflows/code-quality.yml` runs four gates on every PR to `main`: `fallow-regression` (Vue), `jscpd-regression-csharp`, `jscpd-regression-vue`, and `resharper-pr-gate` (C# inspections). All four are diff-scoped so existing technical debt doesn't block merges.
+
 ### Build Cache
 
 The linter, test, and build verification scripts use caching to avoid redundant rebuilds. If you encounter stale cache issues (e.g., linter showing warnings for already-fixed code), clear the cache:

package.json

@@ -24,6 +24,7 @@
         "audit:dupes": "node scripts/audit-jscpd.js",
         "audit:resharper": "node scripts/audit-resharper.js",
         "audit:resharper:pr": "node scripts/audit-resharper-regression.js",
+        "audit:resharper-staged": "node scripts/audit-resharper-regression.js --staged",
         "mailpit:start": "node --env-file-if-exists=.env.local scripts/manage-mailpit.js start",
         "mailpit:status": "node --env-file-if-exists=.env.local scripts/manage-mailpit.js status",
         "mailpit:stop": "node --env-file-if-exists=.env.local scripts/manage-mailpit.js stop",

scripts/audit-resharper-regression.js

@@ -11,10 +11,15 @@
 //   node scripts/audit-resharper-regression.js [--base origin/main]
 //                                              [--sarif inspect-report/inspect.sarif]
 //                                              [--skip-scan]
+//                                              [--staged]
 //
 // --skip-scan reuses the SARIF from a prior `audit:resharper` run, useful in
 // CI where the full scan and the gate are split into separate steps so the
 // expensive scan output can be uploaded as an artifact.
+//
+// --staged filters findings to staged C# lines (`git diff --cached`) instead of
+// PR-diff lines. Pair with --skip-scan for fast iterative pre-commit checks
+// against an existing SARIF report.
 
 const fs = require("node:fs")
 const path = require("node:path")
@@ -30,7 +35,7 @@ const MAX_BUFFER_BYTES = 268_435_456
 const MAX_FINDINGS_PER_RULE = 5
 
 function parseArgs(argv) {
-    const args = { base: "origin/main", sarif: DEFAULT_SARIF, skipScan: false }
+    const args = { base: "origin/main", sarif: DEFAULT_SARIF, skipScan: false, staged: false }
     const remaining = [...argv]
     while (remaining.length > 0) {
         const flag = remaining.shift()
@@ -40,6 +45,8 @@ function parseArgs(argv) {
             args.sarif = remaining.shift()
         } else if (flag === "--skip-scan") {
             args.skipScan = true
+        } else if (flag === "--staged") {
+            args.staged = true
         } else {
             console.error(`Unknown arg: ${flag}`)
             process.exit(2)
@@ -49,9 +56,10 @@ function parseArgs(argv) {
 }
 
 // Returns Map<repoRelativePath, Set<lineNumber>> of lines added/modified in
-// the PR, derived from `git diff --unified=0 base...HEAD`.
-function getChangedLines(baseRef) {
-    const result = spawnSync("git", ["diff", "--unified=0", `${baseRef}...HEAD`, "--", "*.cs"], {
+// the diff selection: PR-mode uses `git diff base...HEAD`; staged-mode uses
+// `git diff --cached` (staged-vs-HEAD).
+function getChangedLines(diffSelector) {
+    const result = spawnSync("git", ["diff", "--unified=0", ...diffSelector, "--", "*.cs"], {
         cwd: PROJECT_ROOT,
         encoding: "utf8",
         windowsHide: true,
@@ -164,20 +172,27 @@ if (!fs.existsSync(args.sarif)) {
     process.exit(1)
 }
 
-const changed = getChangedLines(args.base)
-console.log(`Comparing against base ${args.base}: ${changed.size} C# file(s) with added/modified lines`)
+const diffSelector = args.staged ? ["--cached"] : [`${args.base}...HEAD`]
+const diffLabel = args.staged ? "staged C# changes" : `base ${args.base}`
+const noChangesMsg = args.staged
+    ? "✅ No staged C# changes; nothing to gate."
+    : "✅ No C# changes in this PR; nothing to gate."
+const touchedLabel = args.staged ? "staged" : "PR-touched"
+
+const changed = getChangedLines(diffSelector)
+console.log(`Comparing against ${diffLabel}: ${changed.size} C# file(s) with added/modified lines`)
 if (changed.size === 0) {
-    console.log("✅ No C# changes in this PR; nothing to gate.")
+    console.log(noChangesMsg)
     process.exit(0)
 }
 
 const regressions = findRegressions(args.sarif, changed)
 if (regressions.length === 0) {
-    console.log("✅ No new ReSharper warnings at PR-touched lines.")
+    console.log(`✅ No new ReSharper warnings at ${touchedLabel} lines.`)
     process.exit(0)
 }
 
-console.error(`\n❌ ${regressions.length} new ReSharper warning(s) at PR-touched lines:\n`)
+console.error(`\n❌ ${regressions.length} new ReSharper warning(s) at ${touchedLabel} lines:\n`)
 const byRule = new Map()
 for (const r of regressions) {
     if (!byRule.has(r.ruleId)) {

scripts/audit.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
-// `npm run audit` — run both fallow and jscpd whole-project audits.
+// `npm run audit` — run all whole-project audits (fallow, jscpd, ReSharper).
+// Note: ReSharper inspectcode adds several minutes to the run.
 
 const path = require("node:path")
 const { spawnSync } = require("node:child_process")
@@ -16,9 +17,9 @@ function runNode(script) {
     return result.status ?? 1
 }
 
-// Run both audits unconditionally so a failure in the first doesn't hide the
-// second's findings; aggregate exit codes at the end.
-const codes = ["audit-fallow.js", "audit-jscpd.js"].map(runNode)
+// Run all audits unconditionally so a failure in one doesn't hide the
+// others' findings; aggregate exit codes at the end.
+const codes = ["audit-fallow.js", "audit-jscpd.js", "audit-resharper.js"].map(runNode)
 const max = Math.max(0, ...codes)
 if (max !== 0) {
     process.exit(max)