feat(eslint): enforce cyclomatic complexity limit on new code

[edelauna]

Description

Adds a cyclomatic complexity lint rule (max 18) to the shared ESLint base config and generates suppression baselines for all existing violations across the monorepo.

How it works:

• complexity: ["error", 18] is added to packages/config-eslint/base.js, applying to all workspaces
• Each workspace gets an eslint-suppressions.json baseline (ESLint v9.24+ bulk suppressions feature) that silences pre-existing violations
• All lint scripts already run with --max-warnings=0, so any new function exceeding complexity 18 will fail CI
• When an existing violation is fixed, ESLint flags the now-unused suppression entry, nudging the baseline to shrink over time

Why remove onlyWarn:
The eslint-plugin-only-warn plugin was downgrading all rules to warnings, which prevented --suppress-all from recognising error-level violations to baseline. Since every lint script already enforces --max-warnings=0, the plugin was redundant — removing it makes the suppression mechanism work correctly without changing CI behaviour.

Test Procedure

• Run pnpm lint from the repo root — should pass with no new errors
• Add a function with complexity > 18 to any workspace and run lint — should fail

Pre-Submission Checklist

• Issue Linked: This PR is linked to an approved GitHub Issue (see "Related GitHub Issue" above).
• Scope: My changes are focused on the linked issue (one major feature/fix per PR).
• Self-Review: I have performed a thorough self-review of my code.
• Testing: New and/or updated tests have been added to cover my changes (if applicable).
• Documentation Impact: I have considered if my changes require documentation updates (see "Documentation Updates" section below).
• Contribution Guidelines: I have read and agree to the Contributor Guidelines.

Summary by CodeRabbit

• Chores
  • Strengthened linting configuration by adding stricter complexity rules.
  • Added comprehensive suppression mappings across many packages and test files to record rule exceptions.
  • Removed an unnecessary ESLint dev plugin from the project configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a native ESLint complexity rule (["error", 18]) to the shared config, removes eslint-plugin-only-warn, and populates per-workspace eslint-suppressions.json files with per-file counts for complexity and SonarJS rule suppressions across the repository.

Changes

ESLint Complexity Rule Enforcement

Layer / File(s)	Summary
ESLint baseline configuration and plugin replacement packages/config-eslint/base.js, packages/config-eslint/package.json	Adds eslint-plugin-sonarjs and includes sonarjs.configs.recommended, removes the eslint-plugin-only-warn plugin and devDependency, and adds a complexity rule configured as ["error", 18].
ESLint suppression configuration files apps/cli/eslint-suppressions.json, apps/vscode-e2e/eslint-suppressions.json, packages/build/eslint-suppressions.json, packages/cloud/eslint-suppressions.json, packages/core/eslint-suppressions.json, packages/ipc/eslint-suppressions.json, packages/telemetry/eslint-suppressions.json, packages/types/eslint-suppressions.json, packages/vscode-shim/eslint-suppressions.json, src/eslint-suppressions.json, webview-ui/eslint-suppressions.json	Adds or fills eslint-suppressions.json files with detailed per-path suppression entries and numeric count values for complexity and multiple sonarjs/* rules across apps, packages, the src tree, and webview UI files.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through configs, tidy and spry,
I swapped a plugin for a rule that’s high,
Then mapped exceptions, file by file,
So linters frown a little less awhile,
A carrot for clean code — hop, apply! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description omits the required 'Related GitHub Issue' section, missing the critical 'Closes: #' link that every PR must have per the template.	Add a 'Related GitHub Issue' section with 'Closes: #' and the corresponding issue number to comply with the mandatory requirement that every PR be linked to an approved issue.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly describes the main change: enforcing a cyclomatic complexity limit on new code via ESLint configuration, which matches the PR's primary objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/eslint-cyclometric-complexity-setup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/eslint-suppressions.json`:
- Around line 1994-2002: The file
services/code-index/__tests__/config-manager.spec.ts currently accounts for 78
sonarjs/no-clear-text-protocols suppressions; refactor that test file to remove
duplicated clear-text protocol occurrences by extracting repeated setup/mocks
into shared test helpers or fixtures (e.g., a reusable mock server/helper used
by the test suite) and update the spec to call those helpers so individual tests
no longer require inline clear-text protocol stubs; after refactoring, remove
the now-unnecessary sonarjs/no-clear-text-protocols suppressions from the test
and then run the linter to verify the suppression count for
sonarjs/no-clear-text-protocols in eslint-suppressions.json decreases
accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ae5effd9-d08f-4681-a88b-f297b2cb3e86

📥 Commits

Reviewing files that changed from the base of the PR and between 220b00a and 1e4035a.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (13)

• apps/cli/eslint-suppressions.json
• apps/vscode-e2e/eslint-suppressions.json
• packages/build/eslint-suppressions.json
• packages/cloud/eslint-suppressions.json
• packages/config-eslint/base.js
• packages/config-eslint/package.json
• packages/core/eslint-suppressions.json
• packages/ipc/eslint-suppressions.json
• packages/telemetry/eslint-suppressions.json
• packages/types/eslint-suppressions.json
• packages/vscode-shim/eslint-suppressions.json
• src/eslint-suppressions.json
• webview-ui/eslint-suppressions.json

✅ Files skipped from review due to trivial changes (3)

• packages/config-eslint/package.json
• apps/vscode-e2e/eslint-suppressions.json
• webview-ui/eslint-suppressions.json

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/vscode-shim/eslint-suppressions.json

[edelauna]

I'm worried this will add a bit too much developer friction - so just waiting to merge this. I think it makes sense, however I need a bit more time to evaluate how much friction this is going to add.