[rqbazan]

Summary

This moves theme-toggle to the toolchain the other Lab repos share: pnpm 12, TypeScript 7, Biome 2.6, Vitest 5 and @rrlab/cli 1.7.0. Its git hooks now come from @rrlab/cli, and gitleaks scans each commit and each pull request.

 mise.toml
-pnpm 10.30.3
+min_version 2026.10.19; pnpm 12.16.1; gitleaks 8.30.1   (mise.lock in format 3; Node locked at 24.22.2)
 package.json
-packageManager: pnpm@10.30.3
+devEngines.packageManager: pnpm ^12.16.1, onFail error
-typescript ^6.0.3, @biomejs/biome ^2.0.0 (2.5.1), vitest ^4 with @vitest/browser* 4.1.12, playwright 1.61.1
+typescript ^7.0.2, @biomejs/biome ^2.6.4, vitest 5.0.5 with @vitest/browser* 5.0.5, playwright 1.64.1, vitest-browser-react 2.3.0
-tsdown ^0.22, oxlint ^1.0.0 (1.71.0), oxfmt ^0.73.0, oxlint-tsgolint ^0.25.0, lefthook ^2.1.9
+tsdown ^0.23.4, oxlint ^1.90.0, oxfmt ^0.75.0, oxlint-tsgolint ^7.0.2005, lefthook ^2.2.2
-@rrlab/cli ^1.3.2 and its plugins and configs
+@rrlab/cli ^1.7.0, biome-plugin ^1.2.3, biome-config ^0.0.7, oxc-plugin ^1.3.0, ts-config ^0.0.6, tsdown-config ^0.2.1, tsdown-plugin ^1.3.0, vitest-plugin ^0.3.0
 lefthook.yml
-inline jobs: rr jsc, rr tsc
+extends @rrlab/cli's base.yml (jsc, tsc, gitleaks), a shared-hooks guard; pre-push pnpm test (unchanged)
 .github/workflows
+ci.yml: checks ("Check, test and build") and secrets (gitleaks over the pull request's commits); Test passes only when both do
+mise-action v5.2.3 with mise 2026.10.19; zizmor 1.31.1; permissions granted per job

Exceptions

None.

Calls made here

• vitest is pinned exactly to 5.0.5, where the repo otherwise uses ^: @vitest/browser and @vitest/browser-playwright 5.0.5 require exactly vitest 5.0.5, and ^5.0.5 resolved 5.1.0.
• Test check: the work moved to a checks job, secrets is the scan the other Lab repos run, and Test needs both with if: always(), so a failed scan fails the required check instead of skipping it. Triggers are unchanged (pull requests only).
• Biome 2.6 formats Markdown and YAML: biome.json skips .mise/locks, .changeset/*.md, CHANGELOG.md and pullfrog.yml, and uses the installed Biome's schema. brand/README.md took Biome's table alignment.
• Changeset: a patch for @variablelab/theme-toggle. rr pack's output changed with tsdown 0.23 and TypeScript 7: the bundle's comments and the declarations' layout differ, and the API doesn't.
• Left as they were: release.yml's create-github-app-token pin; workflow-audit.yml's triggers; vite 8.1.0's advisories, tracked in Dependency audit found known vulnerabilities #25.

Evidence

• Before: main runs pnpm 10, TypeScript 6 and Vitest 4, and its hooks have no secret scan.
  After: checked on this branch:

  Check	Result
  pnpm rr check	Biome checked 29 files, no fixes; oxlint's type-aware check passes on TypeScript 7.0.2
  pnpm test	Vitest 5.0.5 in the browser: 2 files, 25 tests passed
  rr pack	tsdown 0.23.4 emits dist/initial.js, dist/index.mjs and the declarations with TypeScript 7.0.2
  Fresh clone: mise install twice, then pnpm install	git status empty; lefthook wrote pre-commit and pre-push
  Fresh clone: a staged fake ghp_ token	commit refused, leaks found: 1, HEAD unchanged; a harmless commit then passes all four jobs

Merge Danger

Door: two-way

Reverting the squash restores main.

Blast Radius: contributors, CI and the next release

• Contributors need mise 2026.10.19 or later and pnpm 12. npm inside the repo stops with EBADDEVENGINES, as devEngines intends.
• The next release publishes a patch of @variablelab/theme-toggle built by tsdown 0.23 and TypeScript 7.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J1Ak7btEZVEoTBDd6NBH9g

[changeset-bot]

🦋 Changeset detected

Latest commit: 4ed3755

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@variablelab/theme-toggle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the toolchain alignment on 900d564: pnpm 12, TypeScript 7, Biome 2.6, Vitest 5, shared git hooks, and the CI secret-scan gate. Library source is untouched.

• Runtime pins — mise 2026.10.19 locks Node 24.22.2, pnpm 12.16.1 and gitleaks 8.30.1, with checksums in mise.lock.
• Package manager contract — packageManager is replaced by devEngines.packageManager (pnpm ^12.16.1, onFail: error). CI still installs the mise pin.
• Dev dependencies — TypeScript 7.0.2, Biome 2.6.4, Vitest 5.0.5 pinned exactly (matching @vitest/browser*), and @rrlab/cli 1.7.0 with its plugins.
• Git hooks — lefthook.yml extends @rrlab/cli's base.yml (Biome, typecheck, gitleaks) and fails the commit if that file is missing. Pre-push still runs the tests.
• CI gate — checks and secrets run in parallel. The required Test job passes only when both succeed. Workflows use hash-pinned mise-action v5.2.3 and zizmor 1.31.1, with permissions granted per job.
• Formatter scope — Biome skips lockfiles, changesets, the changelog and generated pullfrog.yml. brand/README.md is only a table reflow.
• Release note — a patch changeset for declaration and comment layout. The API is unchanged.

  ^{｜ View workflow run ｜ Using grok-4.7 ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the commit since 900d564. The package-manager gate now requires the same pnpm the toolchain already installs.

• Exact pnpm pin — devEngines.packageManager.version and the lockfile specifier are 12.16.1, matching mise.toml, instead of ^12.16.1. onFail stays error.

  ^{｜ View workflow run ｜ Using grok-4.7 ｜ 𝕏}