Repository navigation
Worklist: clear the #2391 follow-ups, one PR each #2440
Description
A worklist for an agent-driven run. Seven issues left over from the #2391 modernization sequence, each to land as its own PR. Every open decision has already been made — each issue carries a comment recording it, so nothing here should need to stop and ask.
Read the linked issue and its comments before starting each one. The comments are where the decisions and the corrected scoping live; several issue bodies have details that later work made stale, and those corrections are in the comments rather than edited into the body.
Ground rules
- One PR per issue. Branch from
main, never from another issue's branch. - Follow the repo's PR template —
## Overview,## Screenshots(leave present but empty),## Testing, then a footer linking the issue. Overview is one or two paragraphs on the why. Testing is a- [ ]checklist of concrete manual steps written for a reviewer with no deep knowledge of the app; skip anything CI already gates. - Run the repo's checks before opening a PR. CI runs four jobs —
lint,build,build-storybook,test— which correspond tonpm run lint:check,npm run type,npm run build,npm run build-storybook,npm test. Do not open a PR with a failing check. - Use the pinned Node.
.nvmrcis 24.19.0; runnvm usefirst. The lockfile is v2 — preserve that withnpm install --lockfile-version 2if you touch dependencies, and pin new devDependencies exactly, as the other 61 are. - Changesets are decided by one test: does the PR change a file we publish, per the
filesarray inpackage.json?.storybook,*.stories.js,*.mdxandscriptsare not published.dist,src/compiled/tokens,src/**/*.scss,src/**/*.twigandsrc/assetsare. - Verify published output rather than assuming. If a PR could touch
dist, build before and after and compare byte for byte. This sequence has repeatedly found that a green build says nothing about whether output changed — see the notes on weak signals in Dependency modernization: Node 24, Vite, and Storybook 10 #2391. - Do not close the issue in the PR body unless the PR fully resolves it; use "Part of #NNNN" where it does not.
Order
The batches matter. Issues within a batch touch disjoint files and can run in parallel; batches should be sequential.
Batch 1 — parallel, fully independent
| Issue | Change | Changeset |
|---|---|---|
| #2415 | Delete one dead glob entry in .storybook/main.mjs |
No |
| #2427 | One regex in scripts/rollup-root-entry.mjs |
Patch |
| #2423 | Remove engines from package.json, and the dead rule from .renovaterc.json |
Patch |
These three are small, decided, and touch nothing in common. #2427 has a verified fix and measured before/after sizes in its body.
Batch 2 — after batch 1
| Issue | Change | Changeset |
|---|---|---|
| #2431 | Three items: a test rename, the root-level .ts lint project, and @import → @use |
No |
Held back because it touches tsconfig.json, which batch 3 also touches. The @use swap has an explicit bail-out condition — read the decision comment. If output changes meaningfully, stop and file an issue rather than pushing through; a partial PR is the correct outcome there.
Batch 3 — after batch 2
| Issue | Change | Changeset |
|---|---|---|
| #2429 | Type story files with Storybook's CSF types; remove the tsconfig.json exclude |
No |
203 errors, 147 of them one code. The decision comment carries the full breakdown and the approach. This is the largest mechanical change of the set — 84 files — so it goes on its own.
Batch 4 — after batch 3
| Issue | Change | Changeset |
|---|---|---|
| #2428 | Discovery, not a fix. Audit the CSF migration | No |
Do not run this alongside #2429 — both rewrite the same 84 story files and will conflict on nearly every one. Its deliverable is a report, not a sweep of fixes; read the comment before starting. Fixes it turns up should be separate PRs.
Not for an agent
#2430 cannot be completed automatically. There is no .github/dependabot.yml — Dependabot is enabled through repository settings, so turning it off is a human admin action. An agent may prepare the .renovaterc.json half (configuring vulnerabilityAlerts, and the :automergeMinor decision) but must say plainly in the PR that the settings change is still outstanding. Skip it unless explicitly asked.
Things this repo has learned the hard way
Worth internalising before touching anything, all from the #2391 sequence:
- A green
build-storybookdoes not mean the stories work. Restore the iframe heights docs stories lost in the CSF migration #2420 fixed thirty stories that had been rendering clipped to 100px for weeks; the build passed the whole time, because something did render. Look at the deploy preview. - The deploy preview does not exercise the published CSS. Storybook compiles Sass through Vite and never loads
dist/standalone.min.css. Changes to the published stylesheet need checking separately. npm run buildpassing locally does not mean it passes in CI. A stale directory thecleanscript did not empty once made a broken build look fine. Test from a clean checkout when the build changes.- A silently narrowed filter fails quietly. Upgrade the misc toolchain: Style Dictionary 5, cssnano 8, sass, js-yaml 5, npm-run-all2 9 #2422 found
color/cssstill registered, still listed, still running, and matching nothing. Diffing output caught it; no check would have. - Your verification harness can be the thing that is broken. A story sweep during Remove gulp #2432 reported 255 of 337 pages as empty; the harness was reading the wrong container. A catastrophic-looking result is usually the harness — check it before acting on it.
Current state
main is at 1048a5bd, version 17.1.0, with seven unreleased changesets pending (six patch, one minor) — next release is 17.2.0. Batch 1 adds two more patches.
Branch protection requires an approving review, so every PR will queue for a human regardless of how many run in parallel.
Related: #2391, and the individual issues linked above.
Activity
spaceninja commentedon Aug 24, 2026
Run complete. Six of the seven are closed; #2430 was scoped out of this worklist from the start and stays open on its own.
What shipped
welcome.mdxglob removed from.storybook/main.mjs-args.files excluded from the published bundleengines.nodeand its now-dead Renovate rule removed.tslint project,@import→@usetsconfigexclude removed<Story>prop the CSF migration droppedEleven changesets now pending, ten patch and one minor, so 17.2.0 is still the next release.
Corrections to this worklist's own assumptions
Recording these because they were wrong in ways that changed the work:
src/index-with-dependencies.scssis excluded from the publishedfiles; it is not —filesexcludessrc/index.scssbut not its sibling. That file was shipping, and it cannot compile for a consumer: it loads@wordpress/block-librarythrough../node_modules/, which resolves inside our own package directory, and that is a devDependency. Filed and fixed assrc/index-with-dependencies.scssis published, and cannot work for a consumer #2445.docs.story.height. They do not:Parametersis declared{ [name: string]: any }, so a doubly-misspelleddocs.stroy.hieghttype-checks clean. What the types do catch is unknown top-level story keys, which is how three realargTypesdefects surfaced.@useswap was not output-neutral, though it passed rather than triggering the bail-out. Seven@font-facerules had been emitted twice under@importand are now emitted once; all other CSS is byte-identical.inline: falsefiles is thirteen.icon.stories.jsmatches a grep but that is the Icon component's owninlinearg.Beyond the type errors
#2429 was scoped as mechanical typing, but typing the metas surfaced six classes of
argTypesthat did not match Storybook's API — eightoptionslabel maps in the Storybook 5/6 object form, eight malformedtype: { name: 'enum' }missing theirvalue, anoptionslist nested insidecontrolwhere Storybook does not look for it, a control type in the arg-type slot, fourdefaultValue.summaryvalues of the wrong type, and a JSDoc@paramnaming a value as a type. Fixed there because they were the type errors; the rest of that territory stayed with #2428.The lesson this repo keeps relearning
"Your verification harness can be the thing that is broken" earned its place again. The #2428 audit harness lied four times before it was trustworthy: story names read from a
name:nested insideargs;argTypes,shorthand counted as absent; a key-path stack that recorded nothing because a CSF body has no enclosing brace; and apostrophes in prose comments (Storybook's,Don't) opening a string literal and swallowing the rest of the file, which manufactured twelve phantom dropped props. Every intermediate number looked plausible — 150 missing, then 286, then 22, then 0. Hand-checking each hit is what kept them out of the report.Still open
#2430 — unchanged, and still not an agent task. There is no
.github/dependabot.yml, so Dependabot is enabled through repository settings and turning it off is a human admin action. #2443 did remove theengineshalf of the.renovaterc.jsonrule it would have had to reason about, so it starts from a slightly cleaner place.#2428's Part 2 was deliberately taken only as far as the cases with a documented obsolete reason. The remaining eleven are not regressions — the sweep proved those settings were carried across faithfully from the original MDX — so revisiting them would be a fresh design call. The state of each is recorded on that issue.