FerroxLabs IJFW Preflight
Runs 11 deterministic quality gates locally. Ordered fast-to-slow, fail-fast on blockers. Returns exit 0 on clean, exit 1 on findings.
Usage
ijfw preflight
What it checks
- shellcheck -- shell script correctness
- oxlint -- fast JS/TS linting
- eslint-security -- high-signal JS security rules
- psscriptanalyzer -- PowerShell scripts, with static fallback when pwsh is absent
- publint -- package.json publish hygiene
- gitleaks -- secret / credential scan
- audit-ci -- npm dependency vulnerability check
- knip -- dead code and unused exports
- license-check -- dependency license compatibility
- pack-smoke --
npm packroundtrip +ijfw --helpassert - upgrade-smoke -- upgrade from floor version, assert settings key survives
- stale platform count -- runs
scripts/preflight-stale-count.sh; fails if any shippable surface still contains the old "8 platforms" string - unresolved execute-issues -- reads
.ijfw/state/execute-issues.json; refuses preflight if any entry hasstatus: unresolved. Missing file treated as zero issues (day-1 fresh-install protection). Canonical read stub:[ -f ".ijfw/state/execute-issues.json" ] || printf '{"issues":[]}'
Behavior
- Each gate degrades gracefully to "skipped: tool not installed" when its CLI is absent (except blockers, which print actionable install hints).
- All output uses positive framing. No "failed" headers -- findings are reported as "surfaced N points".
- Runs under 90s on M-series laptop with warm caches.
- Pinned tool versions tracked in
.ijfw/preflight-versions.json.
When to run
- Before every
git tag/ release. - After any change to shell scripts, package.json, or dependency list.
- In CI (
.github/workflows/ci.ymlrunsijfw preflighton every push).