Skip to content

chore: import eslint config#2723

Open
jackw wants to merge 64 commits into
mainfrom
jackw/import-eslint-config-grafana
Open

chore: import eslint config#2723
jackw wants to merge 64 commits into
mainfrom
jackw/import-eslint-config-grafana

Conversation

@jackw

@jackw jackw commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

What this PR does / why we need it:

The eslint config package that lives in https://github.com/grafana/eslint-config-grafana goes somewhat unnoticed and requires work to bring it up to speed with our security best practices. Rather than duplicate a load of CI / config I think it makes more sense to bring it over here where we'll keep a closer eye on it and get all the security hardening efforts made in this repo for free.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Important

We must do the following once merged and before doing any releases:

  1. update the access settings for the eslint-config package on npmjs.com
  2. push a tag on main so release-please works

@jackw jackw self-assigned this Jun 11, 2026
@jackw jackw requested review from a team as code owners June 11, 2026 12:59
@jackw jackw requested a review from ashharrison90 June 11, 2026 12:59
@cla-assistant

cla-assistant Bot commented Jun 11, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@grafana-catalog-project-bot grafana-catalog-project-bot Bot moved this from 📬 Triage to 🔬 In review in Grafana Catalog Team Jun 11, 2026
jackw added 18 commits June 11, 2026 15:09
Zoltan/refactor and version bump
* Minor changes

* Match dependency versions with other @grafana packages

* Version bump
* Use dependencies for now

... so that it's not installed to a plugin's node_modules/@grafana/toolkit/node_modules dir but to the parent one where eslint can find it. We can reverse this when we migrate from yarn back to npm (v7+) which installs peerDependencies.

* Version bump
* Use hard dependency versions

... to match toolkit and core because building plugins with toolkit cannot find eslint plugins; perhaps due to version collisions

* Version bump
Adds eslint-plugin-react with recommended setings enabled
chore: update repository for github packages
academo and others added 22 commits June 11, 2026 15:09
Chore: Use get-vault-secrets without exporting env variables
| datasource | package | from   | to     |
| ---------- | ------- | ------ | ------ |
| npm        | eslint  | 9.12.0 | 9.38.0 |

Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Co-authored-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Co-authored-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Mitigates supply-chain risk from malicious post-install hooks.
Co-authored-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Co-authored-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
)

* chore: make the package esm only and update some deps

* chore(yarn): update lock file

* feat: remove legacy config

* feat: add linter.config for typings

* Wip

* Wip

* feat: tidy up changelog and deps

* chore: delete package-lock.json file

* Update index.js

Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com>

* revert: remove disabled react-hooks rules for grafana/grafana

* chore(deps): bump react-hooks plugin to 7.1.x to support eslint 10

* docs(changelog): add eslint 10 support note

---------

Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com>
@jackw jackw force-pushed the jackw/import-eslint-config-grafana branch from 0dcdf21 to 44c2fd7 Compare June 11, 2026 13:09
@jackw jackw force-pushed the jackw/import-eslint-config-grafana branch from dcd1900 to 3213848 Compare June 11, 2026 14:05

@sunker sunker left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if it would make sense to dogfood this by letting the other packages in this monorepo use local package rather than published version?

This package contains a single flat config object which can be imported like so:

```js
const grafanaConfig = require("@grafana/eslint-config/flat");

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this still relevant?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No it's not. I'll do it in a separate PR to validate releases are working. Thanks @sunker !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 🔬 In review

Development

Successfully merging this pull request may close these issues.

7 participants