Moved ghost/core boundary enforcement to dependency-cruiser by ErisDS · Pull Request #29134 · TryGhost/Ghost

ErisDS · 2026-07-06T14:53:46Z

Why

ghost/core's frontend/server/shared layer boundaries are enforced by the custom ghost/node/no-restricted-require rule in ghost/core/eslint.config.mjs. That rule is specific to eslint-plugin-ghost and has no equivalent in oxlint, so it stands in the way of the planned ESLint → oxlint migration. It also only inspects require() calls, so it misses ESM imports.

What

Moves the four boundary rules onto dependency-cruiser, which enforces them on the resolved module graph (both require and import) from the repo root:

core/shared must not depend on core/server or core/frontend
core/frontend must not reach core/server/models directly
core/frontend may cross to core/server only via the services/proxy seam (allowlisted)
core/server must not depend on core/frontend (allowlisted)

The custom no-restricted-require blocks (and their now-unused path/__dirname imports) are removed from the ESLint config. The original burn-down intent — "adding files to this list is an anti-pattern / work down until the list is empty" — and the per-file allowlist categorisation are carried over verbatim from the pre-flat-config .eslintrc.js (they'd been dropped in the flat-config migration).

Enforced in three places:

a cached nx target on the ghost-monorepo root project (lint:boundaries), with scoped inputs so the root project's whole-repo projectRoot glob doesn't defeat caching
a CI step in the lint job
a lint-staged pre-commit signal on staged ghost/core/core files

Behaviour is unchanged: parity verified (0 violations on the same graph the ESLint rules covered), and each rule still fires on a negative test.

Scope

The cross-package apps/* boundary model (foundation-libraries vs apps) surfaced during this work but is deliberately out of scope here and tabled as a follow-up.

Checklist

I've explained my change
I've written an automated test to prove my change works — n/a (tooling/config change; enforced by CI + verified for parity)

cursor · 2026-07-06T14:53:51Z

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

coderabbitai · 2026-07-06T14:54:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b1f1d0c3-c152-4002-9575-946b6118fa3f

📥 Commits

Reviewing files that changed from the base of the PR and between 558830a and f70e1cd.

📒 Files selected for processing (4)

.dependency-cruiser.cjs
.github/workflows/ci.yml
.lintstagedrc.cjs
ghost/core/eslint.config.mjs

💤 Files with no reviewable changes (1)

ghost/core/eslint.config.mjs

🚧 Files skipped from review as they are similar to previous changes (3)

.github/workflows/ci.yml
.dependency-cruiser.cjs
.lintstagedrc.cjs

Walkthrough

This PR replaces ESLint-based architectural boundary enforcement with dependency-cruiser. It adds a .dependency-cruiser.cjs config, wires a new lint:boundaries check into CI, lint-staged, Nx, and package.json, pins dependency-cruiser in the workspace catalog, and removes the equivalent boundary restriction rules from ghost/core/eslint.config.mjs.

Possibly related PRs

TryGhost/Ghost#28807: Both PRs touch Ghost core boundary restrictions for core/shared, core/frontend, and core/server.

Suggested labels: migration

Suggested reviewers: EvanHahn, acburdine

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: moving ghost/core boundary enforcement to dependency-cruiser.
Description check	✅ Passed	The description is directly related to the changeset and matches the stated boundary-enforcement migration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch boundaries-dependency-cruiser

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

🧹 Nitpick comments (1)

package.json (1)
63-63: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider err-long output for clearer boundary-violation diagnostics.

Default depcruise output is terse; --output-type err-long includes the rule's comment/name in the failure output, which would help contributors working through the documented allowlist ("Goal: Work down until only proxy.js remains").
♻️ Optional diff
-    "lint:boundaries": "depcruise ghost/core/core --config .dependency-cruiser.cjs",
+    "lint:boundaries": "depcruise ghost/core/core --config .dependency-cruiser.cjs --output-type err-long",
Also applies to: 122-124
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 63, The lint:boundaries depcruise script currently uses
terse default output, so update the lint:boundaries command to use err-long for
clearer boundary-violation diagnostics. Adjust the package.json script that runs
depcruise so contributors get the rule comment/name in failures, making it
easier to work through the allowlist guidance and locate violations in
ghost/core/core.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@package.json`:
- Line 63: The lint:boundaries depcruise script currently uses terse default
output, so update the lint:boundaries command to use err-long for clearer
boundary-violation diagnostics. Adjust the package.json script that runs
depcruise so contributors get the rule comment/name in failures, making it
easier to work through the allowlist guidance and locate violations in
ghost/core/core.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 17b3d2f3-731d-441a-9bc9-a04fc284a5f9

📥 Commits

Reviewing files that changed from the base of the PR and between 1d33898 and 08670eb.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

.dependency-cruiser.cjs
.github/workflows/ci.yml
.lintstagedrc.cjs
ghost/core/eslint.config.mjs
package.json
pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

ghost/core/eslint.config.mjs

nx-cloud · 2026-07-06T15:24:26Z

🤖 Nx Cloud AI Fix

Ensure the fix-ci command is configured to always run in your CI pipeline to get automatic fixes in future runs. For more information, please see https://nx.dev/ci/features/self-healing-ci

View your CI Pipeline Execution ↗ for commit f70e1cd

Command	Status	Duration	Result
`nx run @tryghost/admin-x-settings:test:acceptance`	✅ Succeeded	11m 28s	View ↗
`nx run-many --target=build --projects=tag:publi...`	✅ Succeeded	<1s	View ↗
`nx run ghost:test:ci:integration`	✅ Succeeded	2m 49s	View ↗
`nx run-many -t test:unit -p @tryghost/kg-markdo...`	✅ Succeeded	8m 22s	View ↗
`nx run ghost:test:integration`	✅ Succeeded	2m 51s	View ↗
`nx run @tryghost/admin:build`	✅ Succeeded	3m 24s	View ↗
`nx run ghost:test:legacy`	✅ Succeeded	3m 24s	View ↗
`nx run ghost-monorepo:lint:boundaries`	✅ Succeeded	6s	View ↗
`Additional runs (11)`	✅ Succeeded	...	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-07-09 15:35:52 UTC

codecov · 2026-07-06T15:45:04Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.07%. Comparing base (a8a9d1b) to head (f70e1cd).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #29134      +/-   ##
==========================================
- Coverage   74.07%   74.07%   -0.01%     
==========================================
  Files        1570     1570              
  Lines      136629   136628       -1     
  Branches    16530    16528       -2     
==========================================
- Hits       101204   101202       -2     
+ Misses      34419    34390      -29     
- Partials     1006     1036      +30

Flag	Coverage Δ
admin-tests	`55.19% <ø> (+0.02%)`	⬆️
e2e-tests	`76.18% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cursor · 2026-07-09T13:43:11Z

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

no ref The frontend/server/shared boundaries were enforced by the custom `ghost/node/no-restricted-require` rule in ghost/core/eslint.config.mjs. That rule is specific to eslint-plugin-ghost and has no equivalent in oxlint, so it blocks the planned ESLint-to-oxlint migration. It also only inspects require() calls, missing ESM imports. The four boundary rules now run on dependency-cruiser, which enforces them on the resolved module graph (require and import) from the repo root. This drops the custom rule and lets the boundaries outlive ESLint. The original burn-down intent — "adding files to this list is an anti-pattern / work down until the list is empty" — and the per-file allowlist categorisation are carried over verbatim from the pre-flat- config .eslintrc.js, having been lost in the flat-config migration. Catching imports as well as requires immediately surfaced one leak the old rule missed: route-settings/activation-bridge.ts imports the frontend routing config, the same crossing validate.js already makes via require(). It is allowlisted alongside validate.js as known, soon-to-be-removed debt. Boundaries stay part of the single `pnpm lint` command: it runs run-many across every eslint lint target plus the boundaries target, so there is no separate lint command to remember. The boundaries target is a cached nx target on the ghost-monorepo root project (scoped inputs so the whole-repo projectRoot glob doesn't defeat caching); it also runs unconditionally in CI and as a lint-staged pre-commit signal. A top-level `pnpm check` runs lint plus tests. The cross-package apps/library model is deliberately out of scope and tabled as a follow-up.

cursor · 2026-07-09T15:21:59Z

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

coderabbitai Bot reviewed Jul 6, 2026

View reviewed changes

ErisDS force-pushed the boundaries-dependency-cruiser branch 2 times, most recently from 6c67989 to 558830a Compare July 9, 2026 13:43

ErisDS force-pushed the boundaries-dependency-cruiser branch from 558830a to f70e1cd Compare July 9, 2026 15:21

ErisDS merged commit 4aaaf29 into main Jul 9, 2026
51 checks passed

ErisDS deleted the boundaries-dependency-cruiser branch July 9, 2026 16:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Moved ghost/core boundary enforcement to dependency-cruiser#29134

Moved ghost/core boundary enforcement to dependency-cruiser#29134
ErisDS merged 1 commit into
mainfrom
boundaries-dependency-cruiser

ErisDS commented Jul 6, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

nx-cloud Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 9, 2026

Uh oh!

cursor Bot commented Jul 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

ErisDS commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Scope

Checklist

Uh oh!

cursor Bot commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

nx-cloud Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Nx Cloud AI Fix

Uh oh!

codecov Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cursor Bot commented Jul 9, 2026

Uh oh!

cursor Bot commented Jul 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ErisDS commented Jul 6, 2026 •

edited

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

nx-cloud Bot commented Jul 6, 2026 •

edited

Loading

codecov Bot commented Jul 6, 2026 •

edited

Loading