feat!: line-weighted coverage aggregation, per-unit floor, and Biome as the only TypeScript linter

[pedromvgomes]

Two breaking changes, plus a reporting bug that has been costing every TypeScript repo. Intended to ship as v2.0.0.

1. Coverage aggregation is line-weighted

A language's figure is now Σ covered / Σ total across every discovered Go module, Rust crate/workspace root and TypeScript package, rather than the unweighted mean of those units' percentages.

The mean gave a 230-line app the same vote as a 4,494-line library. On a nine-package monorepo, one commit that added a 39-line untested file to the smallest package while adding ~1,250 well-tested lines elsewhere read as −2.2 under the mean and +0.44 by line count — the gate failed a change that improved coverage, by five times the true magnitude, in the opposite direction.

Expect every repo's reported coverage to move, upward in every case measured so far, by as much as 9 points.

coverage.floor puts back the signal line-weighting removes: weighting by lines is blind to a small unit nobody tests (0 of 8 lines is 0.1% of an 8,305-line repo). Opt-in, defaults to 0, no baseline and no ratchet — and it is the only gate that runs on pushes to main, because it is the only one that doesn't need a baseline to compare against.

Baselines move to v2/<key>.json on bulwark-state. Entries recorded under the mean are a different quantity, so every consumer takes one clean cache miss and re-records rather than reading a step change as a regression.

2. ESLint is removed; Biome is the only TypeScript linter

typescript.linter accepts biome and nothing else. A config still carrying eslint is rejected with an error naming the removal, rather than accepted and quietly run under Biome — a repo that set that key stated which rule set it gates on.

This fixes a live outage. @typescript-eslint/parser declares typescript as a peer with an upper bound (>=4.8.4 <6.1.0). #42 bumped the pin to typescript@7.0.2, across that ceiling, and npm ci on the committed lockfile has failed with ERESOLVE on main ever since — so installNPMToolchain fails and every consumer with TypeScript gets an install error instead of a lint result. internal/typescript's package doc had recorded that exact hazard; nothing executable enforced it. CI stayed green because this repo has no TypeScript to scan (its only package.json files are the pin manifests, which .bulwark.yml excludes), so self-scan never reaches that code path.

Biome parses TypeScript with its own parser and pins no compiler, so the failure class does not exist for it.

What it costs, measured rather than assumed — scanning a fixture carrying all four vulnerability classes with the pinned Semgrep, which already runs on every ecosystem:

eslint-plugin-security rule	Covered by Semgrep at config: auto
detect-child-process	Yes — and with taint: it names the tainted argument
detect-non-literal-fs-filename	Yes — as a path-traversal finding
detect-unsafe-regex	Partly — dynamic patterns, not literal-pattern ReDoS
detect-object-injection	No

So the real gap is detect-object-injection — the plugin's most commonly disabled rule — plus literal ReDoS. Not four rules. Rebuilding either as a Biome GritQL plugin would be the wrong direction: GritQL matches syntax with no dataflow or taint.

3. Failing checks now print their findings

report() emitted only [FAIL] <name>. executil.Run streams most tools live, so Semgrep and gosec findings reached the terminal anyway — but Biome writes its report to a file (so its own chatter cannot corrupt the JSON), and lintDirBiome's derived findings were dropped on the floor. They existed nowhere: not the terminal, not the captured log, not the PR comment.

Result.Detail carries findings a scanner derived itself; report() prints it under a failing check, indented so a finding's own text can never forge a status line past action.yml's anchored tool_result(). This predates the ESLint removal — lintDir had the same shape — so it has been costing every TypeScript repo all along.

Also in here

• Pin bumps the three Dependabot PRs were carrying: gosec 2.27.1→2.28.0 and x/vuln 1.6.0→1.7.0 (both mirrored into golang.go's constants, which is what those PRs failed on), and Biome 2.5.8→2.5.10. PRs chore(deps): bump golang.org/x/vuln from 1.6.0 to 1.7.0 in /internal/golang/go-pin #36, chore(deps): bump github.com/securego/gosec/v2 from 2.27.1 to 2.28.0 in /internal/golang/go-pin #38 and chore(deps): bump @typescript-eslint/parser from 8.63.0 to 8.67.0 in /internal/typescript/eslint-pin #40 are closed with an explanation.
• Release notes as a convention. docs/release-notes/<tag>.md, assembled into the release header by release.yml and passed with --release-header so it sits above the generated changelog. A missing file is not an error.
• Corrected an AGENTS.md claim while re-verifying Biome: a nested biome.json does not abort bulwark's run. That error fires only when Biome resolves config from the tree; under --config-path a nested config is ignored, on 2.5.8 and 2.5.10 alike. lintDirBiome's branch for it is unreachable today and kept only against --config-path being dropped.

Verification

go build ./..., go test -race ./... and golangci-lint run ./... clean. Behaviour checked end-to-end against real fixtures rather than only in unit tests: the Semgrep coverage table above, Biome's out-of-tree ignores and --config-path precedence on 2.5.10, and the [FAIL] biome(.) output now carrying its findings.

Known gaps

• .agentic-toolkit.lock.yaml is dirty from an unrelated toolkit sync and deliberately not included.
• coverage.Compute still measures languages set to enabled: false, so the aggregate gate reports them — AGENTS.md claims otherwise. floorReport filters, but the real fix is in Compute and would change existing repos' aggregate behaviour, so it belongs in its own change. Both the gap and that reasoning are recorded in AGENTS.md.
• README's action example still pins @v1, which stays accurate until v2.0.0 ships.

[github-actions]

bulwark

• ✅ scan — no findings

• ✅ coverage — go: 64.1% (baseline 57.3%); line naming packages/layout, got: %q", out); summary line naming cleared-of-total, got: %q", out); floor: N unit(s)"; line naming packages/skipped, got: %q", out.String()); floor line on the main run, got stdout: %q", out.String()); biome(.)" left the developer to re-run the pinned toolchain by hand; biome(.)", "noGlobalEval", "eval() is dangerous", "noUnusedVariables"} {; biome(.)", Err: errors.New("1 finding(s)")},; ") || strings.HasPrefix(line, "[FAIL] ") {; the whole time. A misspelled opt-in that; line and one stderr warning per types-only or; line and a stderr; floor line and a; go patch: 73.5% (166/226 new lines; baseline 57.3%)

📦 Full bulwark output — complete scan and coverage logs.