audit: monorepo audit findings — 2026-07-01

[claude]

Monorepo Audit Report — 2026-07-01

Skills Audited

• Turborepo (best practices from .agents/skills/turborepo/)
• pnpm (best practices from .agents/skills/pnpm/)
• Workleap React Best Practices (best practices from .agents/skills/workleap-react-best-practices/)

Summary

#	Severity	Skill	Finding	File
1	Medium	Turborepo	typecheck task inputs glob test/** never matches the real tests/ directory, so test-file changes don't invalidate the typecheck cache	turbo.json:35
2	Low	Turborepo	Root //#typecheck task inputs omit the root TS files it actually checks (e.g. eslint.config.ts), so their changes don't invalidate the cache	turbo.json:30

Details

1. typecheck task inputs exclude test files (wrong glob + no $TURBO_DEFAULT$)

Severity: Medium
Skill: Turborepo
File: turbo.json:35
Issue:
The typecheck task declares:

"inputs": ["src/**/*.ts", "src/**/*.tsx", "test/**/*.ts", "test/**/*.tsx", "tsconfig.json", "tsconfig.build.json"]

Two problems combine to break cache correctness:

• The package's tests live in packages/logging/tests/ (plural), but the globs reference test/** (singular), so they match nothing.
• The array does not include $TURBO_DEFAULT$, so per Turborepo semantics it replaces the default file set rather than extending it. Test files are therefore entirely absent from the task's hash.

The typecheck script is plain tsc, which uses packages/logging/tsconfig.json. That config has only exclude: ["dist", "node_modules"] and no include, so tsc type-checks the whole package, tests included (this is confirmed by the separate tsconfig.build.json, which does set include: ["src"] for the rslib build only).

Consequence: introducing a type error in a test file (e.g. tests/CompositeLogger.test.ts) does not change any declared input, so Turborepo returns a cached "pass". In CI the package is still selected by the git filter (--filter=...[base.sha]), but the task resolves to a cache hit because none of the declared inputs changed — so the type error is silently missed.

Recommendation: Fix the directory name in the globs (test/** → tests/**), or prepend $TURBO_DEFAULT$ so the declared inputs extend the defaults instead of replacing them:

"inputs": ["$TURBO_DEFAULT$", "tsconfig.json", "tsconfig.build.json"]

---

2. Root //#typecheck inputs omit the files it actually type-checks

Severity: Low
Skill: Turborepo
File: turbo.json:30
Issue:
The root task declares:

"inputs": ["src/**/*.ts", "src/**/*.tsx", "test/**/*.ts", "test/**/*.tsx", "tsconfig.json", "!packages", "!samples", "!docs"]

There is no src/ or tests/ directory at the repo root, so those globs match nothing and (again, with no $TURBO_DEFAULT$) the only real input is tsconfig.json. However, the root typecheck script is tsc against the root tsconfig.json (which excludes packages/samples), meaning it actually type-checks the root-level eslint.config.ts. Because eslint.config.ts is not a declared input, editing it will not invalidate the root typecheck cache, allowing a stale pass.

Recommendation: Include the root files that tsc actually checks — e.g. prepend $TURBO_DEFAULT$ (keeping the !packages/!samples/!docs exclusions), or explicitly add eslint.config.ts.

---