chore(ci): add typecheck scripts for local TypeScript verification

[Harsh23Kashyap]

Summary

Adds the local tooling half and the CI workflow half of issue #1437, closing the loop.

• Root typecheck script in package.json runs tsc --noEmit in every TypeScript workspace via yarn workspaces foreach --all --topological run typecheck.
• Per-package typecheck scripts in backend, db, schemas, and shared (each tsc --noEmit).
• New .github/workflows/typecheck.yml runs the above on every PR targeting main, parallel to the existing lint.yml and test.yml.

This gives contributors a one-command way to type-check locally (yarn typecheck) AND ensures CI enforces type-check within seconds — instead of waiting for the slow next build inside pr-gate.yml.

Why the web workspace is excluded

packages/web's tsc --noEmit depends on .next/types/**/*.ts (declared in its tsconfig.json include) being generated by next build. Web is already type-checked transitively via the Docker build in pr-gate.yml. Adding a separate tsc --noEmit step for web in this workflow would surface no new errors and would add CI minutes. The matrix excludes web; the remaining 4 workspaces (backend, db, schemas, shared) have no .next-generation dependency and type-check cleanly.

How the workflow ensures fresh types

backend's typecheck depends on shared/dist/env.server.d.ts and db's generated Prisma client. Without those being current, tsc --noEmit reports drift as errors. The workflow runs:

1. yarn install --frozen-lockfile (initial install).
2. yarn build:deps — builds schemas, db, shared, query-language in topological order so their dist/ is fresh.
3. yarn workspace @sourcebot/db prisma:generate — ensures the generated client matches the schema.
4. yarn workspaces foreach --all --topological --exclude @sourcebot/web run typecheck — invokes tsc --noEmit in each remaining workspace.

The local-tooling side (yarn typecheck) expects the user to have run yarn build:deps and yarn db:generate once after a fresh checkout. The CI workflow does both automatically.

Why this is scoped to backend/db/schemas/shared (not web)

Web already runs tsc via next build in pr-gate.yml's Docker build step. That type-check is real and runs on every PR; what this workflow adds is a fast tsc signal for the other 4 workspaces that previously had no PR-time type-check at all.

Test plan

• yarn workspace @sourcebot/{backend,db,schemas,shared} typecheck -> 0 (after yarn db:generate and yarn build:deps)
• yarn workspace @sourcebot/web typecheck -> fails as expected (pre-existing .next dependency, out of scope here)
• Local workflow YAML structurally valid (parses; references checkout, setup-node, prisma:generate, typecheck, exclude-web)
• PR chore(ci): add typecheck scripts for local TypeScript verification #1438 updated with two commits: 457af438 (typecheck scripts) and d95c7e59 (workflow file)
• First CI run after PR opens (CodeRabbit + Bugbot will review)

Backward compatibility

None. Pure additive tooling. No source code changes; no new dependencies; one new workflow file.

Risk

• CI minutes: adds a new workflow running tsc --noEmit on every PR. Per-workspace typecheck is fast (~5-30s); total run should be under 2 minutes.
• First CI run may surface pre-existing latent type errors that have been silently rotting (the same reason this PR is valuable). If errors surface, the maintainer can decide to fix them as a follow-up.

Out of scope

• Re-architecting the web tsconfig.json to split build-time types from source types.
• Adding tsc --watch for dev mode.
• Replacing the existing pr-gate.yml Docker build's type-check step with this workflow's step.

Refs #1437, Closes #1460

---

Note

Low Risk
Additive CI and npm scripts only; no application source changes, though the new gate may fail on pre-existing type errors.

Overview
Adds yarn typecheck at the repo root and per-workspace tsc --noEmit scripts so backend, db, schemas, shared, and web can be checked locally; root and CI exclude @sourcebot/web because its check needs .next types from next build (web stays covered by pr-gate.yml).

Introduces .github/workflows/typecheck.yml on PRs to main: install, yarn build:deps, prisma:generate, then topological typecheck on the non-web workspaces—giving a fast PR signal alongside lint/test without waiting on the Docker build.

^{Reviewed by Cursor Bugbot for commit 3089755. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Added automated type checking for pull requests targeting the main branch.
  • Added project-wide type-check commands across backend, database, schema, shared, and web packages.
  • Ensured checks run in dependency order after required builds and generated database client setup.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds no-emit typecheck scripts to all workspaces, a root command for dependency-ordered execution, and a pull-request GitHub Actions workflow that prepares dependencies and runs the checks.

Changes

Workspace typecheck automation

Layer / File(s)	Summary
Workspace scripts and root orchestration package.json, packages/{backend,db,schemas,shared,web}/package.json	Each workspace adds tsc --noEmit, while the root package runs workspace typechecks in topological order.
Pull-request typecheck workflow .github/workflows/typecheck.yml	The workflow installs dependencies, builds prerequisite workspaces, generates the Prisma client, and runs ordered typechecks while excluding @sourcebot/web.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• chore(ci): add dedicated TypeScript typecheck workflow and root typecheck script #1437 — Covers the workspace TypeScript checks and associated CI workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR adds the requested PR-time typecheck workflow, root and workspace scripts, and excludes @sourcebot/web as required.
Out of Scope Changes check	✅ Passed	The changes are additive and confined to typecheck scripts and the new workflow, with no unrelated code or dependency changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: adding typecheck scripts for local TypeScript verification.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Harsh23Kashyap]

Can someone take a look when you have a chance?

[Harsh23Kashyap]

Can someone take a look when you have a chance?

[Harsh23Kashyap]

Can someone take a look when you have a chance?

[Harsh23Kashyap]

All three cursor threads resolved (intentional exclusions for db/schemas; no query-language typecheck target yet). CI green. Standing by for a maintainer pass.

[Harsh23Kashyap]

All three cursor threads resolved (intentional exclusions for db/schemas; no query-language typecheck target yet). CI green. Standing by.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/typecheck.yml (1)

24-27: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable credential persistence in the checkout action.

By default, actions/checkout persists the GitHub token in the local git config. Since this workflow only requires contents: read and does not push changes, explicitly disabling credential persistence improves security hygiene and mitigates potential credential exposure risks (such as the artipacked vulnerability).

🔒️ Proposed fix to disable credential persistence

       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           submodules: "true"
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/typecheck.yml around lines 24 - 27, Update the Checkout
repository step using actions/checkout@v4 to disable credential persistence by
setting persist-credentials to false in its with configuration, while preserving
the existing submodules setting.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/typecheck.yml:
- Around line 24-27: Update the Checkout repository step using
actions/checkout@v4 to disable credential persistence by setting
persist-credentials to false in its with configuration, while preserving the
existing submodules setting.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ef33f27b-7bcd-402f-99cd-724b27790208

📥 Commits

Reviewing files that changed from the base of the PR and between 457af43 and d95c7e5.

📒 Files selected for processing (1)

• .github/workflows/typecheck.yml

[Harsh23Kashyap]

Still 0 behind upstream. All 3 cursor threads resolved (intentional exclusions for db/schemas, no query-language typecheck target yet). CI green. Standing by.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 8feb437. Configure here.}