audit: monorepo audit findings — 2026-04-01

[claude]

Monorepo Audit Report — 2026-04-01

Skills Audited

• Turborepo (best practices from .agents/skills/turborepo/)
• pnpm (best practices from .agents/skills/pnpm/)
• Workleap React Best Practices (best practices from .agents/skills/workleap-react-best-practices/)

Summary

#	Severity	Skill	Finding	File
1	Medium	Turborepo	PR test step uses pnpm filter instead of turbo filter, bypassing task caching	.github/workflows/ci.yml

Details

1. PR test step bypasses Turborepo caching

Severity: Medium
Skill: Turborepo
File: .github/workflows/ci.yml:89-95
Issue: The Test packages step uses pnpm test --filter=...[${{ github.event.pull_request.base.sha }}] for PR builds. When --filter is passed to pnpm test, pnpm applies the filter at the pnpm level and invokes each matched workspace package's test script directly — in packages/logging that is vitest --config vitest.config.ts --no-watch. Vitest runs directly, bypassing Turborepo entirely and forfeiting turbo's task caching for tests. Every other task (Build, ESLint, Typecheck) consistently uses pnpm turbo run <task> --filter=...[$SHA], which correctly routes through Turborepo. The comment on the test step ("For a PR, only test the packages that are diverging…") is identical in intent to the others, indicating the inconsistency is an oversight rather than a deliberate choice.
Recommendation: Change the PR test command to use turbo's filter directly:

- name: Test packages
  run: |
    if [ "${{ github.event_name }}" == "pull_request" ]; then
        pnpm turbo run test --filter=...[${{ github.event.pull_request.base.sha }}]
    else
        pnpm test
    fi

---