audit: monorepo audit findings — 2026-03-01

[claude]

Monorepo Audit Report — 2026-03-01

Skills Audited

• Turborepo (best practices from .agents/skills/turborepo/)
• pnpm (best practices from .agents/skills/pnpm/)
• Workleap React Best Practices (best practices from .agents/skills/workleap-react-best-practices/)

Summary

#	Severity	Skill	Finding	File
1	Medium	Turborepo	typecheck and eslint tasks lack dependency-aware caching, causing stale cache hits	turbo.json

Details

1. typecheck and eslint tasks lack dependsOn, causing stale cache hits in samples/web

Severity: Medium
Skill: Turborepo
File: turbo.json

Issue: The typecheck and eslint tasks have no dependsOn configuration:

"eslint": {
    "inputs": ["$TURBO_DEFAULT$", "!README.md"],
    "outputs": ["node_modules/.cache/eslint"]
},
"typecheck": {
    "inputs": ["src/**/*.ts", "src/**/*.tsx", "test/**/*.ts", "test/**/*.tsx", "tsconfig.json", "tsconfig.build.json"],
    "outputs": ["node_modules/.cache/tsbuildinfo.json"]
}

Because @workleap/logging uses JIT exports ("exports": "./src/index.ts" — raw TypeScript source), changes to packages/logging/src/** are not included in the cache hash for samples/web's typecheck or eslint tasks. Turborepo will return a stale cache hit for samples/web after changes to packages/logging, potentially masking type errors or lint violations that would only surface in the dependent sample.

Recommendation: Add a transit node to preserve parallel execution while fixing cache invalidation:

{
  "tasks": {
    "transit": { "dependsOn": ["^transit"] },
    "eslint": {
      "dependsOn": ["transit"],
      "inputs": ["$TURBO_DEFAULT$", "!README.md"],
      "outputs": ["node_modules/.cache/eslint"]
    },
    "typecheck": {
      "dependsOn": ["transit"],
      "inputs": ["src/**/*.ts", "src/**/*.tsx", "test/**/*.ts", "test/**/*.tsx", "tsconfig.json", "tsconfig.build.json"],
      "outputs": ["node_modules/.cache/tsbuildinfo.json"]
    }
  }
}

The transit task matches no script in any package (so it is a no-op), but it causes Turborepo to include the hash of packages/logging's source tree in the cache key for samples/web's typecheck and eslint tasks. Both tasks can still run in parallel; only their cache keys are affected.

If parallel execution is not a priority, "dependsOn": ["^typecheck"] / "dependsOn": ["^eslint"] is a simpler alternative, though it forces sequential execution.

---