ci: run root vp check and drop persisted credentials (BON-18, BON-19)

[hunterbecton]

Closes BON-18 and BON-19.

BON-18: root vp check

vp check from the repo root is the command in the CLAUDE.md review checklist, and it failed on main because apps/docs/components/logo.tsx was never formatted. The two other files the issue listed were fixed by later PRs. CI never caught it: the per-app check jobs run tsc --noEmit, and only packages/bones runs vp check.

• logo.tsx is formatted (vp check --fix).
• A new job, Repo: Format & Lint, runs vp check from the root. That covers format and lint for every package and app in about 5 s. The per-app tsc jobs stay, since root vp check does not replace them. Lint uses oxlint defaults because the root has no lint config; it passes today with 0 errors and 1 warning on apps/demo/next-env.d.ts, a Next-generated file, which is left alone.

Once this merges, the new job should be added to the main: required checks ruleset so a formatting slip cannot merge.

BON-19: persist-credentials: false

Every actions/checkout@v4 step in ci.yml sets persist-credentials: false (14 existing jobs plus the new one; the issue counted 15, the file had 14). No job in ci.yml runs authenticated git after checkout, and upload-artifact uses its own token. release.yml keeps the default because changesets/action pushes the version branch and the release step pushes the tag.

Verification

Root vp check exits 0 locally. CI on this PR exercises the new job and the checkout change.

Summary by CodeRabbit

• Chores

  • Strengthened automated quality checks to improve consistency and reliability across the project.
  • Enhanced repository security by preventing temporary credential persistence during automated tasks.

• Style

  • Standardized the documentation site’s logo markup without changing its appearance or behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eab0ca6d-3e55-41fb-8ddb-eeee0e204a98

📥 Commits

Reviewing files that changed from the base of the PR and between fc9d735 and df73303.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• apps/docs/components/logo.tsx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CI workflow adds a workspace format and lint check, disables persisted checkout credentials, and reformats the docs logo SVG opening tag without changing its behavior.

Changes

CI workflow updates

Layer / File(s)	Summary
Workspace validation job .github/workflows/ci.yml	Adds a repo-check job that runs vp check with Vite+ caching.
Checkout credential configuration .github/workflows/ci.yml	Sets persist-credentials: false on checkout steps across CI jobs.

Logo markup formatting

Layer / File(s)	Summary
SVG opening tag formatting apps/docs/components/logo.tsx	Condenses the <svg> opening element to one line without changing its attributes or rendering behavior.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to df733

The PR adds root formatting and lint checks, formats the affected file, and disables persisted checkout credentials in CI while preserving release authentication behavior. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the two primary changes: adding the root vp check CI job and disabling persisted checkout credentials.
Description check	✅ Passed	The description explains the purpose, implementation details, scope, exceptions, and verification results. It covers the template's What/Why and Testing requirements through detailed sections, althoug…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the purpose, implementation details, scope, exceptions, and verification results. It covers the template's What/Why and Testing requirements through detailed sections, although it uses ## Verification instead of ## Testing.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hunter/bon-18-root-vp-check-fails-on-three-files-untouched-since-before-pr

---

_{Comment @coderabbitai help to get the list of available commands.}