Lint the frontend with eslint in its own Docker stage (closes #47)

script/lint ran prettier --check, the same check script/fmt-check
runs, so the JavaScript had no linter. eslint now runs with its
recommended rules, set in eslint.config.js, in a new frontend-lint
stage of Dockerfile built from the pinned node image and the lockfile.
The frontend stage copies a file from it, as the builder stage does
from the Go lint stage, so the image cannot build unless eslint passed.
script/lint builds both lint stages with --no-cache and runs no linter
on the host; script/fmt-check keeps prettier on the host, and
script/frontend-check drops its lint step. The viewport harness fixes
the two kinds of finding eslint made. bootstrap wants node 22.13.0, as
eslint 10 does. Also covers item 2 of
#28.

Model: opus-5-5

script/bootstrap

@@ -24,9 +24,9 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Pinned versions, 2026-07-07
 NODE_VERSION="22.17.0"
 # The oldest node the frontend's dependencies accept: the "engines"
-# field of puppeteer-core 25.5.0, the most demanding of them, asks for
-# 22.12.0 or newer, 2026-09-29. An older installed node is not used.
-NODE_MIN_VERSION="22.12.0"
+# field of eslint 10.12.0, the most demanding of them, asks for 22.13.0
+# or newer, 2026-10-03. An older installed node is not used.
+NODE_MIN_VERSION="22.13.0"
 NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
@@ -270,7 +270,7 @@ main() {
 
     if missing docker; then
         echo "bootstrap: docker not found; make lint, and so make check" >&2
-        echo "  and the pre-commit hook, need it to run the Go linter" >&2
+        echo "  and the pre-commit hook, need it to run the linters" >&2
     fi
     if [ -n "$path_hint" ] && [ -d "$BIN_DIR" ]; then
         echo "bootstrap: add $BIN_DIR to the front of your PATH, e.g." >&2

script/frontend-check

@@ -1,9 +1,10 @@
 #!/bin/sh
-# script/frontend-check: run the frontend half of the checks only (test,
-# lint, fmt-check). This exists for the frontend stage of Dockerfile, a
-# node image with neither Go nor Docker; the Dockerfile's lint and
-# backend build stages gate the backend half. Everywhere else, use
-# script/check, which covers the whole repo. Must not modify any files.
+# script/frontend-check: run the frontend tests and format check only.
+# This exists for the frontend stage of Dockerfile, a node image with
+# neither Go nor Docker; the Dockerfile's frontend-lint stage runs the
+# frontend linter, and its lint and builder stages gate the backend.
+# Everywhere else, use script/check, which covers the whole repo. Must
+# not modify any files.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -11,7 +12,6 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
     "$ROOT/script/frontend-test"
-    "$ROOT/script/frontend-lint"
     "$ROOT/script/frontend-fmt-check"
 }
 

script/frontend-lint

@@ -1,12 +1,15 @@
 #!/bin/sh
-# script/frontend-lint: run the frontend linter (prettier in check mode).
+# script/frontend-lint: run eslint over the frontend. This runs inside
+# the frontend-lint stage of Dockerfile, the digest-pinned node image
+# with the packages from yarn.lock. From a checkout, run `make lint`,
+# which builds that stage.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    yarn prettier --check .
+    yarn eslint .
 }
 
 main "$@"

script/lint

@@ -1,19 +1,21 @@
 #!/bin/sh
-# script/lint: lint the whole repo: prettier over the frontend, then the
-# Go linter over backend/.
+# script/lint: lint the whole repo: eslint over the frontend, then the Go
+# linter over backend/.
 #
-# The Go linter runs only in Docker: this builds the lint stage of
-# Dockerfile, the digest-pinned golangci-lint image, which runs the
-# backend's fmt-check and lint targets. --no-cache makes the linter
-# really run every time rather than reuse an earlier result, and the
-# stage is built for its checks alone, so no image is kept.
+# No linter runs on the host: this builds the frontend-lint and lint
+# stages of Dockerfile, the digest-pinned node and golangci-lint images.
+# The first runs eslint; the second runs the backend's fmt-check and
+# lint targets. --no-cache makes each linter really run every time
+# rather than reuse an earlier result, and each stage is built for its
+# checks alone, so no image is kept.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/frontend-lint"
+    timeout 300 docker build --no-cache --target frontend-lint \
+        --output type=cacheonly .
     timeout 300 docker build --no-cache --target lint \
         --output type=cacheonly .
 }